ran i27-i 



RANGE SAFETY REGULATION 




Safety, in the context of this regulation, implies a concerted effort by the users of 
the Western Space and Missile Center (HSMC) to operate in a manner that will minimize in 
every way possible the inherent danger in missile operations. This document brings to 
the Center user the safety requirements and procedures established by this Center. 

It is our desire and purpose to assist you in any way so that you can best meet both 
your program objectives and the range safety requirements. Because of the great 
complexity of present space programs, and the inevitable cost of changes in hardware and 
tine schedules, I cannot emphasize strongly enough the importance of nesting with the 
HStiC Director of Safety early in the planning stages. This will ensure the earliest 
launch approval and the optimum in planning from a safety standpoint. 
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RANGE SAFETY REQUIREMENTS 

This regulation establishes Western Space and Missile Center (WSMC) range safety policy 
and defines reqiri regents and procedures for obtaining Range Safety approval for missile 
operations on the Range. It applies to all Range users at or supported by the HSHC, to 
units using the services of, or providing services to the WSHC, and to national agencies 
whose vehicles impact into the Western Test Range (WTR). 
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Chapter 1 

MSHC SAFETY POLICY 

I.K Policy Introduction. WSHC WTS is designated a National Range by Department of 
Defense Directive (BODD) 3200,11, The directive includes safety as an intrinsic part of 
the Range Conmander's responsibility to support the facility user. The WSHC Commander 
(CC) is the final authority for Safety at the KIR, and only the Commander's designated 
representative has the authority for granting waivers or changes to this regulation. 

1.2. Facility User. The facility user is any military and civilian organization or 
Federal Government agency that requires the use of WSHC facilities, including any 
foreign or domestic organization sponsored by a US Government agency. 

1.3. Safety Objectives. The HSft/CC's objective is to make sure all programs using 
WSHC facilities are within acceptable risk Units consistent with nn'ssion requirements 
and national needs. This regulation provides specific requirements, criteria, and 
guidance to protect personnel from inordinate risk, injury, illness, and property from 
loss or damage due to WSHC operations. To achieve an efficient, effective safety 
program, potential safety problems must be identified, evaluated, and either eliminated 
or controlled as early as possible in the system requisition process and throughout the 
system life cycle. 

1.4. Prior Program Approval. Systems, subsystems, operations, and procedures approved 
prior to the date of this regulation remain approved and do not need to meet these new 
requirements unless the WSHC Directorate of Safety (SEJ and the user jointly determine 
fhat: 

.4.1. It is economically and technically feasible to incorporate the later 
requirements into the system. 

■1. The system is modified or changed so much that the existing safety approval no 
longer applies. 

.4.3. A previously unforeseen safety hazard exists. 

,4.4. The system does not meet the requirements as originally accepted, 

.4.5. Established waivers will remain in effect until the new requirements are applied. 

.5. Safety Review Team (SRT) Concept. Safety participation during the initial system 
design period reduces costly engineering changes at a later date, so contact must be 
established with WSHC/SE as early in the system design period as possible. WSHC/SE will 
determine the necessary disciplines within the directorate to support the SRT, WSHC/SE 
will be notified of all technical interchanges (TI), system design reviews (SDR), 
preliminary design reviews (PDRJ, critical design rsyiews (CDR), and safety reviews, and 
is represented at meetings that could affect WSHC {paragraphs 3.2.3 and 4.2.1). All 
design information must be provided to WSHC/SE at least 30 days prior to the design 
reviews. 

1.6. Safety Approval. The user has the basic responsibility for compliance with 
WSHC/SE directives. The organization must demonstrate compliance with WSHC requirements 
prior to requesting approval. Mandatory approvals are: 

1.6.1. Statement of Program Acceptance (SPA). Used for flight and ground safety 
conceptual concurrence. 



1.6.2. Flight Plan Approval {FPAJ. Must be obtained prior to Range acceptance of a 
launch commitment. Proposed plans and supporting data are submitted as outlined in 
chapter 2. 

1.6.3. Missile Systems Ground Safety Approval (HSGSAh HSHC/SE approves all airborne 
systems and their associated ground facilities, and all subsequent modifications used on 
the Will (chapter 3). 



1.6.5. Operation Approval Letter (ML}. Acknowledges preliminary approval for an 
operation involving a particular vehicle within specific constraints. Final approval is 
executed when the Range transmits a green status and alert indication to the Range user 
launch control authority late in the launch day countdown, 

1.7. Safety Waivers. When a waiver is necessary, the formal request must include a 
justification, supported by a technical study. A waiver is granted if the mission 
objectives are considered of sufficient importance to justify the added risk, or when 
compliance with a requirement would impose an unreasonable cost. The WSKC/SE policy 
avoids using waivers except in extremely rare situations. 

1.8. Flight Termination System. All missile and space vehicles flown on the UTS must 
be equipped with a flight termination system according to the requirements of chapter 
4. Depending on the program mission, the flight terminating capability must be 
sustained until a safe, final impact point is established, or orbital injection occurs. 
Snail rockets, as defined in paragraph 2.6, are excluded from this requirement. Flight 
termination action may be taken if: 

1.8.1. Abort line violation is apparent according to the data presented to the KFCQ. 
The abort lines are determined from the data provided in response to chapter I. 

1.8.2. Obvious erratic flight that may result in loss of flight termination control. 

1.8.3. Performance of the vehicle is unknown and the ootential to violate abort lines 
exists. 

1.9. Tracking Aids and Missile Performance Data: 

3.9.1, Tracking Transponder System. All missile and space vehicles flown on the wTR 
must be equipped with a tracking transponder system according to the requirements of 
chapter 4. 

1.9.2. Telemetry Data. All missile and space vehicles flown on the wTR must provide 
the following telemetry data for missile flight safety use: 

1.9.2.1. Telemetry Inertia! Guidance (THIS) data for all inertially guided vehicles 
(paragraphs 2,4.1.15.1. and 2,4.2.15,3). 



1.10.1. Missile, space vehicle, payload, reentry vehicle, or jettisoned component 
impact dispersion areas are not to intentionally encompass land, unless designated as 
target. The Range user is responsible for ensuring that all impacting hardware will 
either sink or be recovered. 
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1,10.2. For stages that contain engines having a multiple burn capability, the impact 
dispersion area, corresponding to any planned cutoff prior to orbital injection, must be 
entirely over water. Trajectories must also be shaped so impact dispersion areas are 
entirely over water at times of other critical discrete events such as arming of engine 
cutoff circuits and backup engine cutoff commands, 

1.11. Safety Holds. A directive to either prevent an operation from starting or 
stopping an operation already underway. Safety holds may be called if: safety criteria 
cannot be assured or maintained; safety criteria are being violated; personnel and 
equipment are or will be unduly jeopardized; or an imminently dangerous situation 
exists. Safety holds may be called by Range Safety representatives, or by responsible 
supervisors in charge of an operation. Each launch system must have the following 
capabilities provided for range safety in the event of unsafe range conditions or loss 
of critical range safety systems: 

l.U.I, Each launch system must have a "hold-fire" capability that will stop the launch 
sequencer (paragraph 4.3.8.3.1.11}. 



1.12. Host Tenant Agreement. The 1st Strategic Aerospace Division {1 STRAD), Strategic 
Air Command (SAC), is the host organization and is responsible for all missile ground 
safety at Yandenberg AFB (VAFBJ, as described in I STRA0R 127-200, Missile Mishap 
Prevention, Missile ground safety authority for all Air Force Systems Command (AFSC) 
facilities and operations at VAFB is delegated to the HSKC/CC bn AFR 1M, Host-Tenant 
Agreement. In addition, the WSMC/CC is responsible for all WSMC facilities and 
Operations at locations other than VAFS, WSftf/SF. is responsible for establishing and 
monitoring the Comander's Missile Ground Safety Program at VAFB and all other HSMC 
locations. 

1.13, Senior Missile Flight Control Officer (SKFCO). The WSMC/CC has final authority 
and responsibility for missile flight safety from launch through impact or orbital 
insertion. During countdown and flight the SMFCO directs flight safety operations as 
the direct representative of the WSKC/CC. 



1.14. Orbital and Recovery Operations, The agency controlling orbital, deorbit, and 
recovery operations is responsible for the safety of persons and property during such 
operations. 

1.15. Manned Vehicle. The vehicle commander is responsible for preventing unacceptable 
hazards to life and property during the time the pilot has flight control. Significant 
risks to the general public are not allowed solely because the vehicle is manned. 

1.16. Range User and Supporting Agencies Responsibilities. The range user and 
supporting agencies are responsible for: 

1. 16.1. Compliance with the requirements of this regulation. 

1.16.2. Coordinating system safety measures with the Range to include changes in the 
design or operation. 

1.16.3. Investigation of safety incidents or anomalies. 

1.16.4. Crew safety for manned systems. 
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Chapter- 1 

FLIGHT ANALYSIS 

2.1, Flight Analysis Introduction. This chapter sets forth requirements the Range user 
must meet before conducting a mission or flight test at the OTR. It establishes 
detailed data requirements pertaining to the trajectory and flight characteristics of 
the following types of test items or missions; 

2.1.1. Surface or air launched ballistic missiles and space vehicles. 

2.1.2. Cruise missiles. 

2.1.3. Surface or air launched small rockets. 

2.1.4. Nonpropulsive objects dropped from aircraft. 

2.1.5. Aircraft and ship sensor support, 

2.1.6 Aircraft and aeronautical systems. 

These requirements are designed tc provide the Range with the basic data to analyze each 
mission for flight safety and to prepare all safety criteria in support of the mission. 

2.2. Flight Safety Approvals: 

2,2,1. It is the intent of WSMC/SE to issue a Statement of Program Acceptance (SPA) 
as early as possible to assure the Range user that the specific test program is 
conceptually acceptable from a flight safety standpoint. For programs that are new to 
the Range, it is important that Flight Safety takes part in discussions with the Range 
user early in the conceptual phase of program development and missile design to make 
sure safety requirements are understood and included in the overall system design. The 
HSfC/SE goal is to assure that all t or most, of the program objectives are satisfied 
without compromising safety. 

2.2.1.1. Approval of the SPA is obtained in direct discussions with W5KC/SE during the 
early development phase of a program to assure an understanding of safety requirements 
and design constraints, when Flight Safety is satisfied the airborne safety system and 
general mission scenarios meet requirements outlined in this regulation, the SPA will be 
issued. It is never too early to discuss program or mission plans with WSMC/SE. A SPA 
should be obtained during early preliminary design for new systems and definition of 
program objectives. Normal ly this should occur prior to, or shortly after, submission of 
program introduction (PI). 

2.2.1.2. SPA is required for each program. The request for an SPA should be made very 
early in the conceptual phase of a new program. This is accomplished during interchange 
meetings with %% prior to program introduction. The following information is 



2.2.1.2.1, Basic program objectives. 

2.2.1.2.2. Booster and vehicle description. 

2.2.1.2.3, if the airborne system is a new design, WSHC/SE needs to be involved to 
define the flight safety system. 

2.2.1.2.4. Vehicle propellant characteristics (TNT equivalency, etc.). 
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2.2. 1,2, 6. General program mission scenarios and proposed target a 



2.2J. 2. 8. Vehicle maximum turn capabilities. 

2.2.1.2.9. Preliminary estimate of vehicle breakup characteristics due to destruct 
action and nominal target area {for ballistic programs) impact dispersion for all 
reentering bodies. 



2.2.2. Flight Plan Approval (FPA) should be requested as soon as possible-, however, 
flight safety requirements, both data and hardware, must be satisfied at the time of 
request. FPA should be obtained no later than mission targeting date. The latter 
should be followed by programs that require FPA issuance on a mission by mission basis. 

2*2.2.1. The FPA is issued, upon request from the Range user, when HSHC/SE is satisfied 
that specific missions) for a given program can be supported within the limits of 
flight safety control capabilities to provide positive protection to life and property 
whenever possible. The FPA is based on detailed analysis of program objectives, vehicle 
performance, and other data items required by this regulation. The FPA identifies 
safety constraints for mission support and specific conditions of the approval. Any 
constraints or conditions identified in the SPA may he superseded by those stated in the 
FPA depending on circumstances. The FPA is final and remains in effect throughout the 
life of a program as long as missions remain within specific safety constraints. 

2.2.2.2. When requesting FPA, the Range user provides the following information in 
writing to WSHC/SE: NOTE: Reference may be made to documentation previously submitted, 
where applicable. If specific data are not available, the best engineering estimate 
should be given. 

2.2.2.2.1. Number and designation of launches the proposed flight plan applies to. 

2.2.2.2.2. A statement indicating whether the proposed flight plan is similar to some 
prior mission. 

2.2.2.2.3. Intended launch date{s). 

2.2.2.2.4. Description of vehicle configuration, including the guidance and control 
system. 

2.2.2.2.5. Payload description sufficient for hazard assessment {explosives, 
radioactive materials, high pressure vessels, etc.), 

2.2.2.2.6. Description and location of destruct systems and inadvertent separation 
destruct devices, or statement that the proposed system is similar to one already in use. 

2.2.2.2.7. Tracking aids, including their locations. 

2.2.2.2.8. Type of propellants. If a vehicle has the capability of detonating as a 
result of self- initiation, destruct system activation, ground or water impact, data for 
blast damage assessment is required. The following data must be submitted: 
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3.2.2.2.8.1. TNT equivalency vs flight time of each separate stage, and each possible 
combination of stages that could result from malfunction conditions. 

2.2.2.2.8.2. The probability of detonation vs flight time for each of the following: 
self- initiation, destruct system activation, and ground or water impact. 

2.2.2.2.8.3. Description of methods used to minimize the possibility of detonation. 

2.2.2.2.8.4. Time of day when launches will be scheduled vs number of launches. 
2.2.2.2.9. Trajectory data: 



2.2.2.2.9.2. X, V, Z, X, Y, Z, as functions of time throughout powered flight. If 
position and velocity components cannot be provided, with the approval of WSMC/SE 
range and altitude values may be substituted for X, Y, 1, and the total earth-fixed 
velocity relative to the pad may be substituted for X, Y, t The data should be 
provided in time intervals of less than five seconds. 

2.2.2.2.9.3. Geodetic coordinates of launch site or location. 

2.2.2.2.9.4. Map showing the planned locus of vacuum instantaneous impact points for 
the intended flight azimuth or azimuth sector. This map should show three sigma, 
drag- corrected impact dispersion areas for all stages, reentry vehicles, and jettisoned 
bodies. 

2.2.2.2.9.5. Ballistic coefficient or drag data of all nominally jettisoned hardware, 
time of jettison, and free fall trajectory for all major spent stages, 

2.2.2.2.9.6. Range froir the launch pad to the vacuum impact point at times of discrete 
events; such as arming of engine cutoff circuits, ignition of upper stages, firing of 
retrorockets, and the end of burns that occur prior to orbital injection. The trajectory 
must be shaped for vehicles within the plus or minus three sigma limits so these events 
occur while the impact dispersion area is over water. 

2.2.2.2.10. Supporting data and justification. The Range user may be asked to provide 
the following additional supporting data and justification before a decision on FPA can 
be made. NOTE: The need for this information is established in the WSMC/SE response to 
each FPA request or in the initial FPA dis 



2.2.2.2.10.1. A statement of test objectives for powered flight, 

2.2.2.2.10.2. Effect on the program (cost, schedule, data requirements, reliability) if 
the plan is not approved. 

2.2.2.2.10.3. Statement of the test objectives that will not be met if the plan is not 
approved as proposed, 

2.2.2.2.10.4. Any alternate flight plans that will accomplish the program objectives. 

2.2.2.2.10.5. The effect on the program of modifying the proposed trajectory, 

2.2.2.2.10.6. Any other data the Range user may wish to submit. 

2.2.2.2.11. Buoyancy analysis. The Range user performs a buoyancy analysis of all 
impacting hardware. If the hardware will float, a means of sinking or aids to 
recovering floating items must be provided. If recovery is desired, a recovery 
procedure must be provided. 
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2.2.3, An Operation Approval Letter (GAL) is issued by HSKC/SE for each mission. It is 
the final statement indicating that safety preparation to support an operation is 
completed (based on the final submission of the flight safety data package as outlined 
in this regulation), airborne flight safety hardware is installed and checked out, and 
flight safety is ready to support, 

2.2.4. Because of the importance of safety, a flight plan is not approved simply as a 
natter of convenience to the Range user if safer reasonable alternatives exist; nor is a 
destruct system waiver granted just to save the cost of receivers or other equipment. 
Flight pian approval is given or a waiver request granted when, in the Commander's 
judgment, the hazards associated with the proposed test appear reasonable and when the 
test objectives cannot he met in a safer fashion. A probability study serves as one 
basis for deciding whether the hazards are reasonable. If it is not apparent to HSKC 
Flight Safety Analysis Branch (5EV) that hazards involved are of an acceptable level, 
the Range user may be required to conduct a probability study or provide information 
(2.2.5 below) so that WSNC/SEY can make the study to evaluate hazards associated with 
launching a new flight plan, fhe requirements for a probability study are levied, if 
deemed appropriate by NSSC/SEY, during the initial contact with the Range user. A 
probability study is required if the flight plan involves any of the following: 

2.2.4.1. Direct overflight (instantaneous impact position or present position) of land 
prior to thrust termination or orbital injection. 

2.2.4.2. Flight so close to land that destruct criteria is violated by a normal vehicle, 

2.2.4.3. Launch phase trajectory so steep that critical coastal areas cannot be 
protected by standard safety destruct criteria. 

2.2.4.4. A period during flight when land areas cannot be protected from a 
malfunctioning vehicle because either the vehicle has no emergency flight termination 
system or the WSKC flight safety system capability is surpassed by the vehicle's 



2.2,5. The Range user may be required to supply the following reliability and 
malfunction analysis data. MIL: The need for this information is established in the 
initial FPA discussions or in the HSKC/SE response to the FPA request. 

2.2.5.1. Reliability of each stage. 

2.2.5.2. Description of each failure or malfunction mode. An analysis of all 
subsystems should be made to determine those failure modes that would result in impact 
other than nominal. 

2.2.5.3. A table defining flight time seconds (sec) versus malfunction turn probability 
density (per sec) and premature thrust termination probability density (per sec). A 
malfunction turn failure results when a failed vehicle is acted upon by a component of 
force perpendicular to its direction of flight that tends to result in displacement of 
the vehicle away from its planned line of flight. Thrust vector control loss and nozzle 
burn-through represent typical malfunction turn failures. A thrust termination failure 
results when a failed vehicle does not undergo. any side forces. The latter type of 
failure can include engine shutdown, engine reduced thrust, vehicle explosion while on a 
nominal flight path, failure to initiate a programmed turn, and engine ignition failure, 



2.2.5.4. Description of pieces that would survive to i 
2.2.5.4.1. Their impact dispersions. 



2.2.5.4.?. Impact tines. 

2.2.5.4.3. Velocity imparted to etch of these pieces by destruet action. 

2.2.5.4.4. Evaluation of drag characteristics of each piece. 

2.2.5.5. Nominal trajectory data, three sigma lateral trajectory data, turning rates, 
and drag data as described in paragraph 2.4. 

2.3. Lead Times. Lead tiroes for requesting SPA and FPA are discussed in paragraph 
2.2. After FPA is granted, the Range user must provide detailed trajectory and vehicle 
performance data to WSHC/SEV in the specified format according to lead times established 
in table 2-1. Depending on the type of mission or test time, the requirements to be fi^t 
are set forth in paragraphs 2.4, 2.5, 2.6, 2.7, 2.8, or 2.9. 

Vehicle or Missile Type Lead Time 



Ballistic Hissile Single Flight Azimuth, Hultiple 60 days 

Trajectory or Flight Azimuth 
Space Vehicle Single Flight Azimuth or Variable 60 days 

Flight Azimuth 
Ballistic/Space Vehicles Programs with Flight plan Approval 30 days 

(FPA) 

A single Program with FPA covering 15 days* 

missions within a defined envelope 

or an identical mission 
Cruise Hissile Ground or Air Launched 30 days 
Small Pocket Without Destruct System 30 days 
inert Body Air Dropped 30 days 

Aircraft or Ship Miscellaneous 30 days 

Sensor Support 

Aircraft 3 Aeronautical Hiscellaneous 30 days 

Systems 

*No new trajectory is submitted. Requires a special authorization accompanied by 
specific Program neeos for this short lead time. 

Table 2-1. Lead Times. 

2.3.1. If deadlines are not met, WSHC/SEY may not be able to prepare all necessary 
safety criteria in time to support a proposed flight test. In this event, the test or 
mission will not be conducted until adequate safety preparations can be made. 

2.3.2. In meeting the requirements of this chapter, much of the information submitted 
by the Range user may not change from vehicle to vehicle. In such cases, the 
information only needs to be supplied once. However, for each flight test, the Range 
user must state in writing which trajectory tapes or printouts are applicable, and 
specify the document, paragraph, and page number where each required item can be found. 
This statement must be submitted to HSHC/SEY according to the lead times established in 
table 2-1. 

2.3.3. Although the requirements in this chapter are intended to be complete, special 
types of launches or special circumstances may make it necessary to request additional 
information from time to time. Such requests will be made in writing to the Range user. 

2.3.4. In this chapter certain required data items are marked with an asterisk (*), for 
example, the time interval when turn angle graphs are required. The asterisk means that 
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the interval, duration, or magnitude for which the particular item is to be provided 
varies front program to program, and that the value listed is simply a typical value. 
For each vehicle program, HSMC/5EY states the particular value to use for each parameter 
marked with an asterisk. 

2.3.5. The X, Y, I coordinates referred to in this chapter must be referenced to an 
orthogonal, earth-fixed, left-handed system with origin at the launch point. The X, V 
plane should be tangent to the ellipsoidal earth at the origin, the positive X axis 
should coincide with the initial flight azimuth, the positive Z axis should be directed 
away from the earth, and the V axis should be positive to the right looking downrange. 

2.3.6. The Range user must provide a security classification level cross correlation 
matrix table for trajectory information submitted to HSMC/SEY. This matrix table must 
indicate word classification levels for each word in the Binary Computer Decimal (BCD) 
and binary data files when associated with other words in the files in addition to the 
classification level of oach singular word. If classification changes with stages or 
other events, a classificatioa matrix must be included for each change. 

2,4. Ballistic Missile and Space Vehicle Data Requirements. The trajectory and 
performance data requirements in this paragraph apply to all ballistic missiles and 
space vehicles. Lead time requirements are listed in table 2-1. 

2.4.1. The following items are required for each missile flight or group of similar 
flights and should be updated as changes of vehicle configuration occur or revised 
information becomes available. 

2.4.1.1. General information concerning the nature ami purpose of the flight. 

2.4.1.2. A scaled diagram of the general arrangement and dimensions of the missile or 
space vehicle. 

2.4.1.3. Maximum turning capability of the total velocity vector vs time of flight, 
2.4.4.1 below. 

2.4.1.4. Effects of destruct action on each vehicle Stage and drag data for resulting 
pieces, 2.4.4.2 below. 



2.4.1.6. Tracking aids {for example, C-Band beacon) installed in the vehicle that can 
be used for missile flight safety purposes and the location in the stage or section. 

2.4.1.7. Expected impact point or aiming point for each stage of jettisoned body and 
associated drag data, 2.4.4.4 below. 

2.4.1.8. Impact dispersion data for each stage and jettisoned body, 2.4.4.5 below. 

2.4.1.9. Trajectory deviations (or any other conditions) beyond which the launch agency 
is no longer interested in the missile flight, and is willing to accept premature flight 
termination even though the missile may not have reached a dangerous position or 
altitude. 

2.4.1.10. Reentry vehicle description and drag data, 2.4.4.6 below, 

2.4.1.11. Time schedule of events such as ignition, cutoff and separation of each 
stage, firing of separation rockets, jettisoning of heat shields and nose fairings, 
initiation and termination of various control and guidance modes, coast periods, arming 
of engine cutoff circuits, and timer settings for backup engine cutoff signals. 
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2.4.1.12. Maximum possible impact range of each impacting stage or reentry vehicle for 
a missile burning to fuel exhaustion, 2.4.5.6 below. 

2.4.1.13. For variable azimuth launches a complete set of firing tables giving launch 
time, date, initial and effective flight azimuths and profiles. 

2.4.1.14. Land overflight data, 2.4.4,7 below. 

2.4.1.15. Range safety telemetry and TMIG requirements (certain detailed information 
contained in chapter 4], 

2.4.1.15.1. TMIG data is a mandatory requirement as a tracking source for programs 
using a launch vehicle inertia! guidance system. The TMIG data is to be aade available 
in the standard Inter-Range Instrumentation Group (IRIG) format at a 20 pulses per 
second (pps) rate. 

2.4.1.15.1.2. Identification of available malfunction detection indicators with data 
word definition. These indicators are used by the Missile Flight Control Officer (MFCO) 
in verifying the validity of the TMIG data and as a check on the health of the guidance 
system, 

2.4.1.15.1.3. The TMIG data is required at an accuracy that provides an Instantaneous 
Impact Point (IIP) uncertainty no greater than one nautical mile (nm) crossrange and no 
greater than three m in the downrange direction. 

2.4.1.15.1.4. The TMIG data is required during all phases of powered flight. 

2.4.1.15.2. Missile and Flight Termination System data (PCM) shall be made available in 
a format acceptable to the Range at a 20 pps rate. Typical analog and digital telemetry 
data used for flight safety are: 

2.4.1.15.2.1. Attitude data. 

2.4.1.15.2.1.1. Yaw, pitch, and roll, 

2.4.1.15.2.1.2. Yaw, pitch and roll rates, 

2.4.1.15.2.2. Guidance status and performance data. 

2.4.1.15.2.2.1. Gyro pick-offs or Specific Force Integrating Receiver (SFIR) data, 

2.4.1.15.2.2.2. Error voltage. 

2.4.1.15.2.2.3. Staging events. 

2.4.1.15.2.2.4. RV release events. 

2.4.1.15.2.2.5. X-Axis equivalents, 

2.4.1.15.2.3. Airborne instrumentation status, 
2,4.1.15.2.3,1. Battery voltages and current data. 

2.4.1.15.2.3.1.1. Coimand receivers. 

2.4.1.15.2.3.1.2. Transponder. 

2.4.1.15.2.3.1.3. Guidance and control. 
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2.4.1.15.2.3.1.4, Telemetry. 

2,4.1, 15.2.3.J. 5. Nozzle control units and thrust vector systems. 

2.4.1.15.2.3.1.6. Premature Separation System (PSS). 

2.4.1.15.2.3.1.7. Destruct ordnance power sources. 

2.4.1.15.2.3.2. Instrumentation performance data. 

2.4.1.15.2.3.2.1. Command receivers received signal strength. 

2.4.1.15.2.3.2.2. Decoder function outputs. 

2.4.1.15.2.3.2.3. Destruct events. 

2.4.1.15.2.3.2.4. Transponder received signal strength. 

2.4.1.15.2.3.2.5. Transponder Received Pulse Rate Frequency (PRF). 

2.4. 1.15.2. 3.2.6. Transponder power output. 

2.4.1.15.2.3.2.7. Telemetry transmitter power output. 

2.4.1.15.2.3.2.8. Safe and Arm Device (SM) position status. 

2.4.1.15.2.3.2.0. p$s j„|,ii,jt status. 
2.4.I.I5.2.3.2.I0. Coaiand function verification. 

2.4.1.15.2.3.3. Propulsion system data. 

2.4.1.15.2.3.3.1. Thrust charier pressure for all stages. 

2.4.1.15.2.3.3.2. Phase 2ero activation. 

2.4.1.15.2.3.3.3. Fuel pressure, 

2.4.1.15.2.3.3.4. tele extension. 

2.4.1.15.2.3.3.5. Nozzle position. 

2.4.1.15.2.3.3.6. Command destruct receivers Automatic Gain Control (AGE). 

2.4.1.15.2.3.3.7. X, 1, Z, Pendulous Integrating Gyroscope Accelerometer (PIGA) Resolvers. 

2.4.1.15.2.3.3.8. Final stage disposal discrete. 

2.4.1.15.2.3.3.9. General Energy Management System (GENS) or other maneuvers or discretes. 

2.4.1.15.2.3.3.10. Maneuvers or discrete initiation. 
2.4.1.15.3. Real-time Digital Telemetry (TH) data. 

2.4.1.15.3.1. X, V, Z position. 

2.4.1.15.3.2. X, V, Z velocity. 
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2.4.1.15.3.3. X, 1, Z minor cycle PIGA sins, 

2.4.1.15.3.4. Major cycle PISA sums. 
Z.4. 1.15.3.5. Flight safety word. 

2.4.1.15.3.6. Gyro Bide angle indicator. 

2.4.1.15.3.7. Inertia! Measurement Unit (IMU) power. 

2.4.1.15.3.8. Gyro speed control. 

2.4.1.15.3.9. Stage indicator. 

2.4.1.15.3.10. Minor cycle counter. 

2.4.1.15.3.11. Major cycle sync word. 

2.4.1.15.3.12. All other system counter or sync word. 

2.4.1.16. Burning rate of any solid propellants (inche 
pressure, 

2.4.1.17. Percent propellant TNT eqoivalency for each stage. 
, total weight of propellant, and propellant 

2.4.1.19. Approximate tits interval from receipt of a destruct signal at the comand 
antenna until destruct charges explode. 

2.4.1.20. Acoustic intensity contours that are above 85 dB at ID d! intervals generated 
during launch of the vehicle. The predominant acoustical hands above 85 dB at a 
distance of ,5, 1, 2, and 3 nm surrounding the launch pad. 

2.4.1.21. Two types of user input data are required for the Supersonic Aircraft Boom 
Effects Routine (SABER), control information and Hear field Signature (NFS). Flight 
profile data will be obtained by KSH/SE from the nominal trajectory data. 

2.4.1.21.1. Control information required: 

2.4.1.21.1.1. R - distance from vehicle where NFS is determined, in feet (ft). 

2.4.1.21.1.2. LK - length of model of vehicle in feet, 

2.4.1.21.1.3. LR - vehicle length in feet. 

2.4.1.21.2, NFS data with exhaust plume. 

2.4.1.21.2.1. (theta) - roll angle, in degrees. 

2.4.1.21.2.2. H - mach number. 

2.4.1.21.2.3. N - number of points in NFS. , 

2.4.1.21.2.4. X - vehicle station on model where pressure perturbation was measured in 
feet. 



2.4,2. The trajectory data requirments must be calculated using a six degree of freedom 
program. All trajectories, except the three slgma launch area trajectories, must be 
provided from launch up to a point in flight where effective thrust of the final stage 
has terminated or to thrust termination of that stage or burn that places the vehicle in 
orbit. The launch area trajectories are required from lift-off. The trajectories must 
be provided on magnetic tape under AFSCH 80-12. Die magnetic tape, two copies of the 
printout of the tape, and a letter of transmittal are provided to WSMC/SEY according to 
the lead times established in table 2-1. 

2.4.2J. For single azimuth launches, the trajectory data items of 2.4.3 below are 
required for the trajectories specified in paragraphs 2.4.2,1.1 through 2.4.2.2.8 
below. Thes^ trajectories are computed for a normally performing missile. 

2.4.2.3.1. Nominal or reference trajectory, 2.4.5.1 below. 

2.4.2.1.2. Three sigraa maximum-performance trajectory, 2.4.5.2, 2.4.5.3, and 2.4.5.7 



2.4.2.1.4. Three sipa lateral trajectory, 2.4.5.4 and 2.4.5,7 below. 

2.4.2.1.5. Fuel exhaustion trajectory, 2.4.5.6 below. 

2.4.2.1.6. Three sipa steepest launch area trajectory, 2.4.5.5 and 2.4.5.7 below. 

2.4.2.2. For variable azimuth and profile flights, the trajectory data items of 2,4,3 
below are required for the trajectories. These are to be computed for a normal 
performance missile, 2.4.2.2.1 through 2.4.2.2.8 below. 

2.4.2.2.1. Extreme right-hand or steepest nominal trajectory, 2.4.5.1 below, 

2.4.2.2.2. Extreme left-hand or shallowest nominal trajectory, 2.4.5.1 below. 

2.4.2.2.3. Centrally located nominal trajectory, 2,4.5,1 below, 

2.4.2.2.4. Three sigma maximufrperforaance trajectory for the centrally located flight 
azimuth. 2.4.5,2, 2.4.5,3, and 2,4.5,7 below. 



2.4.2.2.7, Fuel exhaustion trajectory, 2.4.5.6 below. 

2.4.2.2.8. Three sigma steepest launch area trajectory, 2.4.5.5 tind 2.4.5,7 below. 

2.4.3. This paragraph lists the trajectory data items required by 2.4,2 above. These 
items must be provided according to the coordinate system, accuracy, and definitions 
specified in AFSCH 80-12. The coordinate system for the AFSCM 80-12 format is also 
defined in paragraph 2,3.5, All data is submitted either in English or metric units. 
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2.4.3.1. I, V, I (ft) vs time (sec). 

2.4.3.2. 'x.Vz (ft per sec) vs time (sec). 

2.4.3.3. Speed = ?X 2 +V +V)" 2 (ft per sec) vs time (sec). 



2.4.3.5. Altitude above earth's surface (ft) vs time (sec). 

2.4.3.6. Total weight pounds (lbs) vs time (sec). 



2.4.3,8. Thrust lbs vs tins (sec). 

£.4,3,9, Instantaneous impact point data, geodetic latitude, longitude, impact range 
rati, and flight time (sec) vs time (sec). 

2.4.3.10. The name, coordinates, and mean sea level elevation of the coordinate system 
origin (launch pad). 

2.4.3.11. Initial flight azimuth in degrees measured clockwise from true north. 

2.4.3.12. Name of sphered ured in trajectory calculations. 

2.4.4. Provide background information and details about the genera! vehicle data 
requirements set forth in 2,4.1 above. 

2.4.4,1. Maxim turning capability angle information is required only for those stages 
that contain an emergency flight termination system, and needs to be computed for the 
nominal or reference trajectcry only. 

2.4.4.1.1. Turning information is needed in order to know, at any time during flight, 
the maximum angle through which the velocity of * malfunctioning vehicle can turn in 
various time intervals. This information is used to determine how fast a vehicle, or 
more exactly, a vehicle's impact point, can attempt to violate an impact limit line if a 
malfunction should occur. Various time intervals, or time delays, must be considered, 
since the delays tut It into the Range safety destruct calculations depend upon the 
accuracy, sensitivity, and type of presentation associated with a particular 
instrumentation system as well as vehicle characteristics. 

2.4.4.1.2. In determining the turning capabilities of a vehicle, the Range user 
considers both trimmed turns and tumbling turns. Ti'inred turn refers to a turn where 
the angle of attack is such that the aerodynamic moment is just balanced by the thrust 
moment. A maximum-rate trimmed turn is a turn made at, or near, the greatest angle of 
attack that can be maintained whether the vehicle is stable or unstable. Tumbling turn 
means the family of turns that result if the airframe rotates through approximately 180 
degrees at various angular rates, each rate being brought about by a different constant 
deflection of the rocket engine. The procedure outlined in 2,4,4.1.2.1 and 2.4.4.1.2.2 
below- should he followed in determining whether trimmed turns, tumbling turns, or both 
should be provided, 

2.4.4.1.2,1. For vehicles that are aerodynamical ly unstable at all angles of attack, 
the following will apply: If the Range user can show that the probability of flying a 
maximum-rate trimmed turn even for a period of only a few seconds is virtually zero, 
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tumbling turns should be computed rather than trimmed turns. If the Range user cannot 
so state, both trimmed turns and tumbling turns must be considered with the larger of 
the two, or both, being provided. In those cases or during that part of the flight 
where the maximum triable angle of attack is small, it may be obvious which type turn 
leads to greater turning angles; however, if the maximum trimmable angle of attack is 
large, trimmed turns will in all probability lead to higher turning angles than tumbling 
turns, and hence more restrictive destruct criteria. Therefore, tumbling turns should 
be submitted at any point where the Range user can state that there is no conceivable 
way for the vehicle to fly a maximum-rate trimmed turn. One possible difficulty needs 
to be mentioned in connection with calculating tumbling turns for unstable vehicles. In 
the higher aerodynamic region it often turns out that no matter how small the initial 
deflection of the rocket engine, the airframe tumbles through 18C degrees or one-half 
cycle in less than eight seconds, the minimum time duration for computing turning angles 
during the boost phase. In such a case, if the computation is carried out for eight 
seconds, part of the angle turned by the velocity vector during the first half cycle is 
then cancelled out during the second half cycle of the turn. If only tumbling turns 
were considered in such cases, the conclusion would be that the vehicle's velocity 
vector can turn through a greater angle in a shorter time period than it can in a longer 
time period. This is an unacceptable conclusion from a safety viewpoint. One generally 
acceptable way to circumvent this difficulty is to compute tumbling turn angles without 
considering aerodynamic forces. Although such a vacuum turn cannot actually be 
simulated in the atmosphere by means of a constant engine deflection, in all likelihood 
there is a particular deflection of the engine that can approximate the turn fairly 
closely. If, however, vacuum tumbling turns are considered completely unrealistic and 
unjustifiable, other types of malfunctions must be considered. If, for times greater 
than the maximum time required to tuiable through 180 degrees, no likely type of 
malfunction can occur that leads to larger turning angles than those achieved for 
tumbling turns, then maximum-rate trimmed turning angles must be provided in addition to 
the tumbling turning angles. 

2.4.4,1,2,2, For vehicles that are stable at all angles of attack, or unstable at low 
angles of attack but stable in some higher angle of attack region, the following shall 
appiy: If the vehicle is sc stable that the maximum thrust moment cannot produce 
tumbling but results instead in trim at some angle of attack less than 90 degrees, 
turning angles should oe computed for this trim angle of attack. If the maximum thrust 
moment results in trim at some angle of attack greater than 90 degrees, turning angles 
should be computed for an angle of attack of % degrees. It is quite likely, hoover, 
that the maximum thrust moment will be capable of tumbling the vehicles. In this event, 
two possible situations arise: large engine deflections result in tumbling, but small 
engine deflections do not; both large and small constant engine deflections result in 
tumbling, irrespective of how small the deflection light be. For the first case, 
tumbling turn envelopes should be generated as prescribed in the 2.4.4.1.2.1 above for 
unstable vehicles. However t the same difficulty discussed there in connection with 
tumbling turns may arise here. The envelope of the computed tumbling turns may fail to 
rise continuously throughout the entire time period when the calculations are to be 
carried out. In this event, either tumbling turn calculations neglecting aerodynamic 
forces or maximum-rate trimmed turn calculations must be made as discussed in the 
preceding paragraph. In the latter case, this situation arises because the stability at 
high angles of attack is insufficient to arrest the angular velocity that is built up 
during the initial part of a tumbling turn where the vehicle is unstable. For this 
case, the turning angles achieved at the stability angle of attack (assuming no 
upsetting thrust moment) are required in addition to the turning angles achieved by a 
tumbling vehicle. Although the vehicles cannot arrive at this stability angle of attack 
as a result of a constant engine deflection, there is certainly some deflection behavior 
that will produce this result. If arriving at such a deflection program is too 
difficult or too time consuming, it is assumed that the vehicle somehow instantaneously 
rotates to the trim angle of attack and stabilizes at this point. In connection with 



the latter case, the Range user may feel that the probability of achieving a trimmed 
turn is extremely small; if so, tumbling turn angles may be used in range safety 
destruct calculations during that part of flight that the envelope rises continuously 
for the duration of the computation. 

2.4.4.1.3, Irrespective of the type of turn computed, turning angle graphs are required 
at even 4* second intervals beginning 4* seconds after first motion and continuing 
through the stage I phase and into the stage II phase for at least one time point, and 
at even 8* second intervals thereafter. One graph is to he provided for eacn 
computation time* with each ordinate representing the total angle turned by the velocity 
vector in degrees and each abscissa the time duration of the turn in seconds. For other 
than tumbling turns, only a single graph is required at each time point. For tumbling 
turns each graph is to represent the envelope of all tumbling turns for all possible 
constant deflections of the rocket engine. In this case, a plot of the individual 
tumbling turn curves that are used to define the envelope must be provided on the same 
graph with the envelope. Additional data required on each graph of turning rates are 
the thrust, weight, and velocity at the beginning of each turn. The time duration of 
each turn is to be at least 12* seconds during the stage I phase, and at least 16* 
seconds for all turns computed thereafter. During the first 100* seconds of flight, 
both pitch turns and lateral turns must be investigated and the larger of the two be 
presented. However, after 100* seconds, turns need be computed only in the lateral 
plane. Lateral turn in this case means the angle turned in the lateral direction by the 
total velocity vector, not the angle turned in the horizontal plane by the horizontal 
component. If pitch and lateral turning angles are essentially the same except for the 
effects of gravity, the lateral turning angles may be determined from the pitch 
calculations that, in effect, have had the gravity component subtracted out at each step 
in the computation. In all such cases and for all pitch turn calculations, the effects 
of gravity should be removed from the final turning angle plots. 

2.4.4.1.4, in addition to the angle turned by the velocity vector, values of velocity 
are also required throughout each turning angle computation. For trimmed turns where 
only a single turning angle curve and a single set of velocity values exist for each 
calculation, velocities are required at one second intervals. For tumbling turns, 
velocities must be provided in graphical form as a function of time for each engine 
deflection used to define the tumble turn envelope. Either total velocity or 
iticreiiifliital change in velocity from time of malfunction can be presented, although the 
incremental change in the velocity is desired. 

2.4.4.1.5, In beginning the various turning angle computations, it should be assumed 
that the vehicle has behaved normally up to the point of the malfunction that produces 
the turn. Computations need not be made for the three sigma maximum and the three sigma 
minimum trajectories, but a method for applying the turning angles to these trajectories 
must be provided. The items of 2,4,3 above must also be supplied for the trajectories 
used to start the turning angle computations, if this trajectory is not one of those 
provided in response to 2.4.2.1 above. Although desirable, this trajectory need not be 
submitted on tape in the standardized format of AFSCK 80-12, A columnar or block 
printout is acceptable for this trajectory. In addition, a complete discussion is 
required of assumptions made, method of calculations, and equations used in deriving the 
turning angles, A statement relative to the probability of occurrence of the various 
type turns considered is required. 

2.4.4,2. TO meet the requirements of 2,4,1.4 above, the following must be provided up 
to thrust termination of the last stage that carries a destruct system; 

2.4.4.2.1. The expected effects of destruct action on the vehicle structure, including 
estimates of the number and approximate weights and cross-sectional areas of pieces, 
All fragments tiiust be included; however, similar fragments such as skin or structural 
vehicle weight should be accounted for in the fragment groups. The description should 
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also include diffusion and dispersion of any toxic or radioactive clouds 

and the radiation and exposure characteristics. This information is necessary to 

develop safety criteria and perform launch area hazard analysis. 

2,4,4,2,?, Estimates of the coefficient of drag (Cj)) versus Hach number specifying 
reference area (A), approximate weight (H), shape and volume should be given for each 
piece or group of pieces resulting from destruct action. For each group of Similar 
fragments the number of pieces, weight variation of pieces, total weight, and variation 
in cross-sectional area of the pieces must be specified. A piece that in the absence of 
wind is expected to travel a maximum distance, and a piece (or pieces) that in the 
absence of wind is expected to travel a minimum distance must be included. All Cn 
versus Hach number curves must be provided in graph form. Include equations for these 
curves if available* 

2.4.4.2.3. The difficulty in estimating drag coefficient curves and weights for vehicle 
pieces is fully realized. If this cannot be done satisfactorily, an estimate of the 
subsonic and supersonic H/CgA for each major piece may be provided instead. In either 
form, three sigma tolerance limits for the drag coefficients given for the maximum and 
minimum distance piece must be included. 

2.4.4.2.4. For pieces that may stabilize during free flight, drag coefficient curves 
should be provided for this angle of attack. If the angle of attack where the piece 
stabilizes is other than zero degrees, both the coefficient of lift (C[_) versus Hach 
nujnber and the Cp versus Hach number curve should be provided. 

2.4.4.2.5. The explosion effect on the remaining fuel and stages are also required, 
particularly with respect to ignition or detonation of upper stages if destruct action 
is taken during the burning period of a previous stage. If one of the upper stages can 
be ignited as a result of destruct action taken on a previous stage, sufficient 
information is required to evaluate the effects and duration of thrust, and the maximum 
deviation that can be brought about by this thrust, 

2.4.4.2.6. Estimate of incremental velocities imparted to the vehicles pieces. 
2.4.4.2.6.1. Vehicle break-up mode data: 

2.4.4.2.6.1.1. A statement indicating the flight time interval when the vehicle is 
experiencing the "high q" flight region. This region is defined as the time during 
flight when the dynamic pressure causes an aerodynamic breakup during a malfunction time 
with the result of little or no crossrange displacement. 

2.4.4.2.6.1.2. For each vehicle stage flight interval, provide fragmentation group 
information resulting from the expected effects of destruct action on the vehicle 
structure, Also, provide information resulting from the "high q" load considerations 
(aerodynamic break-up) as defined in 2.4.4.2.6.1.) above, as well as for an intact 
vehicle. A fragment "group" is one or more fragments whose characteristics are similar 
enough to allow all of the fragments to be described by a single "average" set of 
characteristics. The following information is required for each fragment group: 

2.4.4.2.6.1.2.1, Fragment group name, 

2.4.4.2.6.3.2.2, Nominal, plus three sigma and minus three sigma ballistic coefficient 
values (lbs per square ft), 

2.4.4.2.6.1.2.3. Weight per fragment (lbs). 

2.4.4.2.6.1.2.4. Projected area per fragment (ft 2 }. This information is not required 
for those fragment groups classed as uncontained propellant fragments, 2.4.4,2.6.1.2,6 
below. 



WSHCR 127-1 15 May 1985 Ml 

2.4.4.2.6.1.2.5. Plus three sigma destruct induced velocity (ft per sec). 

2.4.4.2.5.1.2.6. Fragment group type, note 1 below, where: 

1 = inert fragment. 

2 = uncontained propel lant fragment. 

3 = contained propellant fragment. 

4 - explosive fragment. 

2.4.4.2.6.1.2.7. Casualty area per fragment {ft 2 }. The casualty area per fragment 
should be based on a fragment falling vertically at impact. 

2.4.4.2.6.1.2.8. Vehicle stage where fragment group originated. 

2.4.4.2.6.1.2.9. For those fragment groups defined as uncontained propellant 
fragments, contained propellent fragments, and explosive fragments, an indication is 
required as to whether or not the propellant fragments are burning during free fall. 

2.4.4.2.6.1.2.10. For those fragment groups defined as contained propellant fragments 
or explosive fragments, the initial weight of contained propellent (lbs), note 2 below, 
and the consumption rate during free fall (lbs per sec) is required. 

2.4.4.2.6.1.2.11. Fragment terminal velocity {ft per sec). 

HOTE !. Inert fragments contain no volatile type material that could be burning or 
could explode. Uncontained propellant is propellant exposed directly to the atmosphere 
(it is assumed that exposed propellant will not produce a significant explosion upon 
impact). Contained propellant is propellant that is enclosed in a container (such as a 
motor case} but will not explode upon impact. Explosive fragments are contained 
propellant frapents that will explode upon impact. 

HOTE 2. The initial weight of a contained propellant fragment is the weight of the 
propellant in a fragment before any of the propellant is consumed by normal vehicle 
operation.. This propellant weight must be less than the total weight per fragment. 

2.4.4.2.6.2. Destruct Velocity Impact Uncertainties. This data is required for those 
fragments identified in 2,4.4.2.6 above, with a plus three sigma destruct induced 
velocity of greater than 500 ft per sec. This information provides a more realistic 
impact uncertainty due to high velocity destruct fragment modeling. The data required 
can be best shown in terms of a table indicating; 

2.4.4.2.6.2.1. Flight time when the destruct velocity impact uncertainties are to be 
used (sec), 

2.4.4.2.6.2.2. Ballistic coefficients band upper bound values (lbs per ft?). 

2.4.4.2.6.2.3. For each ballistic coefficient band upper bound value at each flight 
time specified above, the destruct velocity impact covariance matrix elements (nr). 
These elements consist of a downrange variance, crossrange variance, and a downrange or 
crossrange covariance. The upper bound ballistic coefficient values define range of 
ballistic coefficients for which the impact uncertainties have been computed (that is, 
from a Monte Carlo analysis). The lower bound for each band can be most easily handled 
if it is assumed to be equal to the upper bound for the previous band with the lower 
bound for the first band being zero. 

2.4.4.3. For typical failures, 2.4.1.5 above, for each stage, a brief discussion about: 
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2.4.4.3.1. Typical malfunctions that may occur-) such as failure of the hydraulic 
system, failure of the guidance or control system, failures that lead to premature 
thrust termination (such as shifting of platform reference, structural failures, 
failure of separation mechanism between stages). 

2.4.4.3.?. Expected or possible vehicle behavior for these failures. 

2.4.4.3.3. An estimate of the probability of their occurrence. Also state any other 
information considered pertinent with respect to critical portions of flight, vehicle 
stability characteristics, and structural limits, 

2,4,4.4. The expected impact points, 2.4.1.7 above, for each stage and jettisoned body 
should be given in terms of geodetic latitude and longitude in decimal degrees, and 
range (nnt) from pad to impact point. Computations should be made for an ellipsoidal 
rotating earth taking into account drag and, if applicable, lift. 



2.4.4.4.1.1. The number of fragments resulting from a specific scheduled jettison. 

2.4.4.4.1.2. Jettison flight time (sec), total weight jettisoned (lbs), reference area 
per fragment (squared ft), and the best estimate of C|j vs Mach number or subsonic and 
supersonic W/CrjA for each stage or piece. 

2.4.4.4.1.3. Three sigma major axis (nn) and three sigma minor axis (nm) impact 
distribution uncertainty and the azimuth orientation of the major axis (degrees 
clockwise from true north). 

2.4.4.4.1.4. Impact ballistic coefficient (lbs per ft?). 

2.4.4.4.1.5. A table of Mach number vs the nominal, minus three sigma and plus three 
sigma drag coefficients and respective reference areas. The Mach numbers for which drag 
coefficients are input must cover the range of possible Mach numbers that could be 
encountered for the scheduled fragments) during free fall. 

2.4.4.5, The impact dispersion data requested in 2.4.1.8 above are required for warning 
notices for civilian aircraft, and in determining what areas, if any, must be clear of 
shipping not associated with the test. Estimates of the three sigma range and 
crossrange dispersions are required for each stage or jettisoned body, assuing a 
normally functioning vehicle. Three sigma wind effects acting, upon the descending body 
or pieces, must be included in the dispersion area. If more than one vehicle piece 
impacts in the vicinity of a particular point, or if any stage is expected to break up 
during reentry, an estimate of the number and size of pieces, their impact range, or the 
extreme range limits for these pieces must also be provided. A brief discussion of the 
method used to determine dispersion should also be provided. 

2.4.4.6, The following information for reentry vehicle description drag data and for 
weapons systems or reentry vehicle development tests is required. The items in 
2.4,4.6.1 through 2.4.4.6.4 below should be provided in records 23, 24, and 25 of the 
SCD file of the AFSCH 80-1? trajectory tape or submitted with general vehicle data. 

2.4.4.6.1. Type of reentry vehicle (ablation or heat sink) and ablation tables when 
applicable. The ablation table should consist of a table of Mach number or altitude vs 
the ratio (w7U and the instantaneous reentry vehicle weight during reentry to the 
unablated reentry vehicle weight. 
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3.4.5.1. The nominal or reference trajectory is the trajectory that the vehicle would 
fly if all vehicle parameters were exactly as expected, if all vehicle systems performed 
exactly as planned, and there were no external perturbing influences. 

2.4.5.2. To generate a sir.gle composite three sigma trajectory, use the following 
procedure: 

2.4.5.2.1. Identify individual parameters (for example, thrust, weight, specific 
impulse, etc.) which significantly affect the IIP performance of the vehicle. Estimate 
three sigma dispersions for these parameters, 

2.4.5.2.2. Run a series of trajectory computations, or simulations, where three sigma 
values of significant perturbing parameters are introduced singly, fit a suitable number 
of points, tabulate the IIP deviations from nominal that have oeen caused by each 
parameter. 

2.4.5.2.3. At each point, calculate the square root of the sun: of the squares of all 
deviations to arrive at the three sigma IIP deviations. 

2.4.5.2.4. By further trajectory computations or simulations, generate a powered flight 
trajectory {a three sigma no-wind trajectory) that matches as closely as possible the 
three sigma deviations calculated in 2,4.5,2.3 above. This may be done b^ perturbing 
only a few key parameters at varying magnitudes throughout the run. 

2.4.5.2.5. Compute the required three sigma trajectory using "worst winds" and the 
parameter magnitudes used to calculate the three sigma no-wind trajectory. The wind 
dispersed trajectories indicate vehicle performance deviations due to the effects of 
severe winds. This data should be supplied until the missile attains an altitude where 
there is essentially no wind effect. It is usually sufficient to use 100,000 feet as 
this altitude limit. Computations should not be limited to wind drift but includes all 
wind effects. The suggested wind profile data for use in these computations are 
contained in the Inter-Range Instrumentation Group, Range Coraanders Council, Document 
104-63, August 1965, Pacific Missile Range Reference Atmosphere for Point Arguello, 
California (part 1), U.S. Government agencies may obtain this report from: 

Secretariat 

Range Commanders Council 

White Sands Missile Range NM 88002 

United States aerospace industries may obtain this report from: 

DDC/IRA 

Cameron Station 
Alexandria VA 23314 

2.4.5.3. The three sigma maximum- and three sigma minimum- performance trajectories 
define, at any time after launch, the limits of normality as far as impact range is 
concerned. The three sigma maximus-performance trajectory provides ths minimum 
downrange distance of the vacuum IIP for any given point in time and the three sigma 
minimum- performance trajectory provides the minimum downrange distance of the IIP for 
any time. In calculating these trajectories, head and tail wind profiles should be used 
that represent the worst wind conditions when a launch would be attempted. For any 
particular time after launch, approximately 99.73 percent of all normal vehicles 
(assuming a normal distribution) that are subjected to the assumed wind will have impact 
ranges lying between the extremes achieved at that time by three sigma maximum- 
performance and three sigma minimum-performance missiles. Of the .27 percent of the 
normal vehicles that fall outside of the three sigma limits, approximately half would be 
short and half would be long. It is recognized that it may not be possible for a 
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2.4.4.6.2, Hie unablated reentry vehicle weight. 

2.4.4.6.3, A table of reentry vehicle drag coefficient versus Hach number of altitude. 

2.4.4.6.4. Reentry vehicle aerodynamic reference area associated with the drag 
coefficients. 

2.4.4.6.5. A description of the effects of explosive warheads, if applicable. This 
description includes, but is not limited to, the: 

2.4.4.6.J. I, Location and altitude of the point where the device is intended to be 
detonated. 

2.4.4.6.5.2. Effects of detonation on the vehicle and reentry vehicle containing the 
device. 

2.4.4.6.5.3. Dispersion of the resulting fragments. The description should also 
include diffusion and dispersion of any toxic or radioactive clouds or fragments and the 
radiation exposure characteristics. 

2.4.4.7. For laud overflight data, the following information is used to establish 
guidelines for safety action decisions. The ultimate use of this inforaation depends on 
land overflight hazards and mission objectives. The requiresent for this information is 
not mandatory; however, with this information rare latitude can be exercised in 
establishing limits for land overflight. The derivation of the following items may be 
lengthy. Therefore, when necessary, KSffi/SE will accept inforaation based on the Range 
user's best estimate, 

2.4.4.7.1. The flight azimuth limits where the prissy test objectives and a useful 
orbit can be accomplished. These azisuth Units are used to establish bounds for safety 
action decisions. For both, a aaplete explanation is required of: 

2.4.4.7.1.1. The powered flight objectives that are met by the azimuth selections. 

2.4.4.7.1.2. The circumstances or type of malfunction that can cause the vehicle to fly 
outside the three sigwa limits of normality but still accomplish use objectives. 

2.4.4.7.1.3. The probability of such a malfunction occurring. 

2.4.4.7.1.4. An explanation of the effect of this malfunction on the success of 
succeeding burns or stages. 

2.4.4.7.2. The most lofted and depressed trajectories where the primary test objectives 
and a useful orbit can be accomplished. These trajectories should consider only 
perturbations that result in deviations in the pitch plane. Position and velocity data 
in the AFSCH 80-12 format are required for these trajectories and the information 
requested in 2.4.4.7.1.1 thru 2.4.4.7.1.4 above; is also required. 

2.4.4.7.3. The minimi (and maximum if it exists) impact range from the pad as a 
function of time when an orbit can be accomplished. These ranges should be such that 
orbit cannot be accomplished if the impact range, as a function of time, is less or 
greater than the limits specified for orbit. This information should be supplied at 
staging times and at sufficient other times to confirm the orbit capability. 

2,4,5, Trajectory data details and background information about the trajectory data 
requirements are set forth in 2.4.2 above. A brief discussion of the parameters 
considered, their standard deviations, and all assumptions and procedures used in 
deriving each of them must be provided. A graph and tabulation of the wind profiles 
used must also be included. 



normally performing, fully guided vehicle to fly either the three sigma maxim- or 
minimum-performance trajectory as defined above. However, what is wanted is a single 
trajectory having an impact range at any time greater than the impact range of 59,86 
percent of all nomal vehicles, and a single trajectory with an impact range at any time 
less than the impact range of 99.86 percent of all normal vehicles. Any deviation 
outside of three sigma limits indicates the vehicle is probably behaving in an abnormal, 
though not necessarily dangerous, fashion. Those parameters having a significant effect 
upon impact range, such as thrust, specific impulse, weight, variation in firing time of 
different stages, and fuel flow rate should be combined in the best way considered to 
produce the required results. 

2.4.5.4. Three sigma lateral trajectory requirements: 

2.4.5.4.1. The three sigma lateral trajectory defines the lateral limits of normality 
for the vacuum IIP. This trajectory is calculated using the worst lateral wind 
condition when a launch would be attempted. For any downrange distance, the IIP trace 
for 99.73 percent of all normal vehicles subjected to the assused wind will lie between 
the nominal and the three sigma lateral IIP traces. Since only one, three sigma lateral 
trajectory is requested for single azimuth launches, the assumption is made that the 
three sigaa left and the three sigaa tight trajectories are syoaetric about the nominal 
trajectory. If this assumption is not reasonable, then both three signa left and three 
sigma right trajectories must be provided. For multiple azimuth launches a similar 
assumption is made with respect to symmetry of the three sigma trajectories about each 
nominal trajectory. However, the further assumption is made that the three sigma 
lateral trajectory computed for the centrally located azimuth can be used to produce a 
three sigma trajectory for any other nominal azimuth simply by reorienting the X and ¥ 
axes of the data. For example, if a three signa lateral trajectory has been computed 
for a fiodinal 2C0 degree flight azimuth, the three sigma lateral trajectory for a 
nominal 190 degree flight azimuth is determined simply by assuming that the X-axis of 
the trajectory is 190 degrees instead of 200 degrees. If this assumption is not 
reasonable, additional trajectories can be defined for any flight azimuth. 

2.4.5.4.2. The three sigma lateral trajectories are needed to determine whether a 
normal vehicle experiencing a three signa deviation violates flight safety destruct 
criteria. In other Instances, they may be used as the priaary criteria for deciding 
whether a vehicle should be allowed to continue in flight or to overfly land. When used 
for comparison with impact predictor destruct criteria, the vacuum IIP data are 
required. However, X, Y, and Z values along the three sigma lateral trajectory are also 
used for comparison with present-position destruct criteria. The three signa lateral 
trajectory, as defined above in terms of IIP, may not provide three sigma deviations of 
the lateral position 7 as a function of X, although this is normally assumed to be the 
case. The Range user should indicate if this assumption is not valid. Although not 
required, it would he useful in this case if the Range user would also submit a three 
sigma lateral trajectory which provides three sigma values of V in terms of X. 

2.4.5.4.3. In calculating a three sigma lateral trajectory, those parameters having a 
significant effect on the lateral deviation of the IIP should be combined in the best 
way considered to produce the required results. The same procedure suggested in 2.4.5.3 
above for calculating three sigma maximum- and minimum-performance trajectories is also 
suggested here. 

2.4.5.5. As the name implies, the three sigma steepest launch area trajectory should 
maximize Z as a function of X. In calculating this trajectory, a wind profile should be 
assumed that represents the worst wind conditions when a launch would be attempted. If 
other factors such as gyro drift or high thrust add significantly to the deviations 
caused by wind, these factors should also be included in the calculations. The steepest 
trajectory is a three sigiu trajectory in the sense that 99.73 percent of all normal 
vehicles subjected to the assumed wind would, for any X, achieve values of I below the 
corresponding Zs along the steepest trajectory. 
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2.4.5.6, For many flights, a programed thrust termination lay he scheduled well in 
advance of fuel exhaustion. To know whether a potential safety problem can arise if the 
vehicle should fail to cut off, trajectory data through fuel exhaustion are needed. For 
weapons system flight, the information should be provided for the last stage only. For 
orbital flights, it should be provided for the stage preceding the stage that achieves 
orbit. The requirement is net by extending either the nominal or three sigia maximum 
trajectory through fuel exhaustion, depending on which produces a greater impact range. 
This trajectory, properly identified, must be presented on magnetic tape according to 
AFSCK 80-12. 

2.4.5.7, if the three sigma trajectories are computed as specified and the proposed 
flight plan is approved by MSKC/SE, the Range user can he certain that a normal vehicle 
does not violate the safety destruct criteria in the launch area. It is usually 
advisable to select profiles from the annual profiles contained in the IRK document 
unless the launch is to be conducted at a particular time of the year and only at that 
time. Care should be exercised in the selection of the cumulative percentage frequency 
of the wind profile used for the computation of these trajectories. Selecting a wind 
profile as severe as the worst wind conditions when a launch would be attempted is 
usually recommended. This has the advantage of relieving the Range user or the 
representative of the task of evaluating wind effects on launch day to make sure the 
vehicle will not violate established flight safety destruct criteria. In critical 
instances, this has the disadvantage of limiting the allowable launch azimuth or 
reducing the allowable launch day winds in the flight safety restrictions for wind drift 
of vehicle fragments resulting from destruct. The wind profiles used in the 
computations should be identified. If the TRIG wind profiles are not used, a tabulation 
of wind magnitude and direction vs altitude is required for the profile actually used. 
KSBC/SE, in the destruct criteria, allows for as ouch vehicle deviation due to wind as 
shown in these trajectories, but does not assume responsibility for the safety of a 
vehicle launched under wind conditions that exceed those used in these computations. 

2.4.6. For air launched ballistic and space vehicles, the data requirements outlined in 
2.4.1 thru 2.4.6 above and paragraph 2.9 apply in addition to: 

2.4.6.1. Type of aircraft and performance capability of aircraft, that is, turn rate, 
climb rate, velocity, etc. 

2.4.6.2. Description of drop aircraft flight plan, such as aircraft flight azimuth in 
degree true, speed, altitude, flight path angle (at missile drop point) of velocity 
vector relative to local horizontal at launch. 

2.4.6.3 For other than level flight launches, add a statement on how the aircraft path 
angle and launch azimuth are determined for missile release. 

2.4.6.4. The expected maximum region around the drop point, that is, a drop point 
envelope where the test is conducted. This is provided as distances downrange, uprange, 
and crossrange relative to the expected drop point and perpendicular to the launch 
azimuth or by providing the geodetic latitude and longitude of the corners of the drop 
box. 

2.4 .6. 5. The rate of drop of launched missile and description of stabilizing system 



7.4.6.6. Method of ignition and position of the missile relative to the earth at igni- 
tion. 

2.4.6.7. A definition and description of events occurring prior to missile release and 
to time of engine ignition. 



WSMCR 127-1 15 Hay 1985 



2.4.6.9, Predicted impacts of jettison hardware and their dispersion associated with 
the missile drop system. 

2.4.6.10. Predicted impact point of jettison hardware and missile, and the associated 
dispersions resulting from ignition failure. Hie dispersions should include wind 
effects to all impacting debris. 

2.4.7. Statement of Vehicle Performance is required within one to three months after a 
failure occurs during a vehicle test. This information is provided by written letter or 
by lending KSBC/SE the performance evaluation documents prepared for other purposes. 
Information desired includes: 

2.4.7.1. Qualitative statement about the performance of each stage and the various 



2.4.7.2. Failures that occurred and resulting flight conditions produced. 

2.4.7.3. Probable cause of failure and corrective action taken. 

2.4.7.4. Impact points for stages. 

2.4.7.5. Hiss distances for weapons systems tests, 

2.4.7.6. Comparison for planned and achieved cutoff for each stage. 

2.4.7.7. Performance of on-board safety instrumentation systems. 

2.5. Cruise Missile Data Requirements. The trajectory and performance data 
requirements set forth under this heading apply to cruise missiles. Lead time 
requirements are listed in paragraph 2.3. 

2.5,1. The following missile related items are required for each missile flight or 
group of similar flights. 

2.5.1.1. General information concerning the nature and purpose of the flight. 

2.5.1.2. A scaled diagram of the general arrangement and dimensions of the missile. 

2.5.1.3. Location of tracking equipment on board the missile that is used for missile 
flight safety tracking, such as S or C band beacon, telemetry transmitter. 

2.5.1.4. General discussion of the typical failures that may occur during flight (for 
example, loss of control, shutdown of engine), an estimate of the probability of 
occurrence for each type of failure, and expected missile behavior for these failures. 
Any other pertinent information with respect to missile stabilty characteristics, 
peculiarities, structural, and g-limits. 

2.5.1.5. Maximum turning capability of velocity vector (deg or sec) vs time of flight 
(sec-iin), 2.5.4.1 below. 

2.5.1.6. A description of the effects of destruct action on the missile and drag data 
for resulting pieces, 2,5.4.2 below. 
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2.5.1.8. Impact dispersion data for each stage and jettisoned body. 

2.5.1.9. Maximum possible impact range for missile burning to fuel exhaustion. 

2.5.1.10. Trajectory deviations (or any other conditions) beyond where the Range user 
is no longer interested in the vehicle flight and thus is Hilling to accept a premature 
flight termination even though the vehicle may not have reached a dangerous position or 



2.5.1.12. Explosive warhead intonation, 2.5.4.3 below. 

2.5.1.13. Graph of maximum cruising speed (ft or seel vs altitude (ft). 



2.5.2.2. For three sigia maximum-altitude trajectory, provide either the data items in 
2.5.3.1 below, or the maximum-altitude high deviations ('in feet] from nominal as a 
function of ground range from the launch or drop point, 2.5.5.2 and 2,5.5,5 below. 

2.5.2.3. Tor three sigia minimum-altitude trajectory, provide either the data items in 
2.5.3.1 below, or the maximum-altitude low deviations (in feet) from nominal as a 
function of ground range from the launch or drop point, 2.5.5.2 and 2.5.5,5 below. 

2.5.2.4. For three Sigma lateral trajectory, provide either the data items in 2.5.3.1 
below or the maximal lateral deviations (feet or miles) from the intended flight path as 
a function of ground range froi the launch or drop point, 2.5.5.3 and 2.5.5.5 below. 

2.5.2.5. For three Sigma high-performance trajectory, provide all data items in 2.5.3.1 
and 2.5.3.2 below from launch or drop until the vehicle reaches a steady state cruise 
condition, 2.5.5.4 and 2.5.5.5 below. 

2.5.3. The following trajectory data items are required for each flight according to 
the requirements and definitions set forth in 2.5.2 above. The information must be 
provided in tabular form in one second intervals for the first two* minutes of flight, 
in 15 second intervals from this point until the missile reaches cruise altitude, in one 
minute intervals throughout the cruise phase until the terminal phase of flight is 
reached, and at 15 second intervals thereafter until test termination or impact. The 
time 0,0 seconds lust correspond to first lotion for pad launched vehicles and to the 
instant of drop for air launchings. 

2.5.3.1, After the first two minutes of flight, with WSHC/SE approval, X, Y, Z, (to the 
nearest foot) vs time (sec) is replaced by ground range along earth's surface from 
launch point to submissile point (ft-miles) vs time (sec-min), altitude above the 
earth's surface (ft) vs time (sec-min), and crossrange displacement (ft-miles) vs time 
(sec-min) . 

2.5.3.2. After the first two minutes of flight, with WSHC/SE approval, X", Y, Z (to the 
nearest one-tenth foot per second) vs time (sec-min) is replaced by speed (ft or sec) vs 
time (sec-min) and path angle of velocity vector relative to local horizontal (deg) vs 
time (sec-min), 
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2,5.3.3. Geodetic latitude and longitude of launch pad or drop point. 

2.5-3.4. Initial flight azimuth in degrees measured clockwise from true north. 

2.5.3,5. A map showing the expected flight path over the surface of the earth, and an 
altitudt profile correlated with the flight path. Tines should be indicated at regular 
intervals along the path. 

2.5,4, This paragraph provides background information ami details about the general 
vehicle data requirements set forth in 2.5.1 above. 

2.5.4.1. Maximum turning capability details are: 

2.5.4.1.1. From launch or drop until cruise altitude is reached, this information is 
required to provide a means of determining the maximum angle that the missile velocity 
vector can turn in the event of missile malfunction. The maximum angles turned for time 
intervals up to about 30* seconds duration are of interest. Both pitch and lateral 
turns should he investigated and the larger presented. It should be assumed the missile 
has behavad normally up to the point of malfunction that produces the maximum rate turn, 
the missile is trisEied to the maximum air load the structure can stand, or the missile 
is flying out of control in an altitude that produces the maximum lateral acceleration 
(for example, a near 90 degree bank with a maximum pitch turn). During the launch 
phase, the missile may not be able to fly for 30* seconds under these extreme 
conditions. In this event, it is assumed the missile is turned at the maximum possible 
rate where flight can be maintained. A complete discussion of the methods used in 
calculating must he provided. This discussion includes all assumptions made, types of 
malfunctions considered, forces producing turns, and equations used. 

2.5.4.1.2. During the cruising phase, the maximum turning rate of the velocity vector, 
as a function of altitude', is required. Rates are based on normal missile weight and 
expected cruising speed at each altitude. For this phase of flight, the data may be 
expressed in the form of maximum lateral accelerations, if desired. A complete 
discusssion similar to that requested for 2.5.4.1.1 above is required. The maximum 
turning rates that the guidance system and the autopilot can command during the cruise 
phase are also required, 

2.5.4.2, For destruct action effects to meet the requirements of 2.5.1.4 above, the 
following must be provided up to thrust termination of the last stage that carries a 
destruct'system. f 

2.5.4.2.1. The expected effects of destruct action on the vehicle structure, including 
estimates of the nuisber and approximate weights and cross-sectional areas of pieces. 
All fragments niust be included; however, similar fragjffints such as skin or structural 
material are grouped together. The total structural vehicle weight should be accounted 
for in the fragment groups. The description should also include diffusion and 
dispersion of any toxic or radioactive clouds or fragments and the radiation and 
exposure characteristics. This information is necessary to develop safety criteria and 
perform launch area hazard analysis. 

2.5.4.2.2. Estimates of the coefficient of drag (Cn] vs Hach number, specifying 
reference area (A), weight (H), and volume (V) for pieces resulting from destruct 
action, A piece that in the absence of wind travels a maximum distance, and major 
piece(s) that in the absence of wind travel a minimum distance must be included, if 
drag coefficient curves for vehicle pieces cannot be estimated satisfactorily, the 
subsonic and supersonic W/CqA for each major piece is provided instead. In either 
form, three sigma tolerance limits for the drag coefficients given for the maximum 
distance piece should be included. For major pieces that can possibly stabilize during 
free flight, drag coefficient curves should be provided for this angle of attack. If 



2-24 WSMCR 127-1 15 May 1985 

the angle of attack where stabilization occurs is other than zero degrees, a lift 
coefficient {C[j vs Hach number curve should also be provided for this angle. In 
addition, drag coefficient estimates are required for vehicle pieces of minimum W/CnA, 
such as missile skin, or fuel tank sections. All Cg and Cj_ vs Hach number curves 
must be provided in graph fori. Include equations for these curves if available. 

2,5.4.2.3. Estimates of incremental velocities imparted to the vehicle pieces that drag 
data are required for in 2.5.4.2 above. 

2,5.4.3, Furnish a description of the effects of explosive warheads, if applicable. 
This description includes, but is not limited to, location and altitude of the point 
where detonation is intended, effects of detonation on the missile and warhead 
(dispersion of missile and missile pieces], and dispersion of fragments of warhead. The 
description should also include diffusion and dispersion of any toxic or radioactive 
clouds or fragments and the radiation and exposure characteristics. 

2.5.5. This paragraph provides background information and details about the trajectory 
requirements set forth in 2.5.2 above. 

2.5.5.1. The nominal or reference trajectory is the trajectory the missile would fly if 
all vehicle parameters were exactly as expected, all vehicle systems performed exactly 
as planned, and there were no external perturbing influences. 

2.5.5.2. The three sigma nasiKimti and Einiausj altitude trajectories define for any 
ground range the limits of normality as far as altitude is concerned. In other words, 
for any particular ground range, approximately 99.7 percent of all norraal missiles 
(assuming a normal distribution) have altitudes between the extremes achieved at that 
point by three sigma max imum- altitude and three sfgraa minimum-altitude missiles. Any 
deviation outside these limits indicate the missile is behaving in an abnormal, though 
not necessarily dangerous, manner. However, the safety officer may destroy such a 
missile if it is approaching a land mass or threatening to get outside or below the 
coianand destruct coverage area. 

2.5.5.3. The three sigma lateral trajectory defines the lateral limits within which 
99.7 percent of all normal missiles are expected to remain. A missile that deviates 
outside these limits is subject to possible destruction as discussed for the maxirauis and 
minimum altitude trajectories, 

2.5.5.4. The three sigma high-performance trajectory should define the vehicle 
capability limits in climbing to maximum altitude at the maximum possible rate. 

2.5.5.5. in computing the three sigma trajectories, those parameters having a 
significant effect upon vehicle dispersion (such as thrust, specific impulse, wind 
weight, and atmospheric density) should be combined in the way best to produce the 
required trajectories. A brief discussion of the assumptions and calculations made in 
deriving these trajectories must be provided. 

2.5.6. For air-launched cruise missiles, the data requirements outlined in 2.5.1 thru 
2.5.5.5 above and paragraph 2.9 are applicable in addition to the following: 

2.5.6.1. Type of launch aircraft. 

2.5.6.2. Description of drop aircraft flight plan. 

2.5.6.3. Aircraft flight azimuth (degrees true), speed (ft per sec), altitude (ft) at 
launch and path angle of velocity vector relative to local horizontal (deg) at launch. 
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2.5. 6.4, For other than level flight launches, a statement on how the aircraft path 
angle and the launch azimuth are determined for vehicle release. 

2.5.6.5. The maximum region around the drop point where drop can occur. This is 
provided as distances downrange, uprange, and crossrange relative to the expected drop 
point, along and perpendicular to the launch azimuth, or by providing the geodetic 
latitude and longitude of the corners of the drop box, 

2.5.7. A statement of vehicle performance is required within one to three months after 
a failure has occurred during a missile test. This information is provided by written 
letter or by sending WSHC/SE the performance evaluation documents prepared for other 
purposes. Information required includes: 

2.5.7.1. Qualitative statement about the performance of each stage and the various 
subsystems, 

2.5.7.2. Failures that occurred and resulting flight conditions produced. 

2.5.7.3. Probable cause of failures and corrective action taken. 

2.5.7.4. impact points for stages. 

2.5.7.5. Kiss distances for weapons systems tests. 

2.5.7.6. Comparison of planned and achieved cutoff conditions for each stage. 

2.5.7.7. Performance of on-board safety instrumentation systems. 

2.6. Small Rocket Data Requirements, The trajectory and performance data requirements 
set forth in this part apply to all small rockets. Small rockets are not required to 
carry destruct systems when dispersion analysis and control of launch conditions 
indicate that the vehicle and debris can be contained within predetermined safe areas. 
Lead time requirements are listed in paragraph 2,3, 



2.6.1.1. General information concerning the purpose of mission, number of launches in 
program, brief description of payload giving weight, and nature of data to be obtained. 

2.6.1.2. Scaled diagram of vehicle. 

2.6.1.3. Latitude and longitude of launcher. 

2.6.1.4. Desired launch azimuth and launch elevation angle giving the variation in 
azimuth and elevation angle that is acceptable from the standpoint of mission 
accomplishment. Indicate which mission objectives actually determine the acceptable 
limits for azimuth and elevation angle. 

2.6.1.5. A brief description of the type of launcher is required and should include 
whether it is a zero length or short rail type, the amount of effective guidance, 
adjustments available in quadrant elevation (QE), azimuth, and the smallest measurement 
for these adjustments. 

2.6.1.6. Total vehicle weight and propellent weight of stages at lift-off. 

2.6.1.7. Coefficient of drag (Cp) vs Hach number, giving reference area (A) and 
weight (W) for expended stage or stages and for payload. Curves must cover Hach number 
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range from zero up through maximum values expected. Also indicate whether bodies are 
stable and, if so, at what angle of attack, and state briefly how drag corves were 
determined. 

2.6.1.8. Required dispersion data: 

2.6.1.8.1. As the three sigma dispersion area is used as the Impact area, a careful 
dispersion analysis is a necessity. The following factors should be considered in 
determining the three sigma dispersion of a predicted impact point: 

2.6.1.8.1.1. Variation in thrust. 

2.6.1.8.1.2. Error in drag estimates. 

2.6.1.8.1.3. Thrust misalignment. 

2.6.1.8.1.4. Fin misalignment. 

2.6.1.8.1.5. Variation in weight. 

2.6.1.8.1.6. Variation in ignition time of stages, 

2.6.1.8.1.7. Impulse error. 

2.6.1.8.1.8. Tip-off and separation. 

2. 6.1. 8.1. 9. Error in wind velocity measurement. 

2.6.1.8.1.10. Error in launcher setting. 

2.6.1.8.1.11. Additional items of possible variation or error. 

2.6.1.8.2. The three sigma variation in each of the above factors must be listed in 
addition to the extent these factors displace the impact point of each stage in 
downrange and crossrange distance from the nominal impact point, in feet or nm. The 
total dispersion is then estimated by statistically combining the impact displacement 
errors introduced by the above factors. 

2.6.1.8.3. The above dispersion data must be supplied for all stages of the vehicle and 
payload, with a complete and detailed summarization containing the methods of 
computation and assumptions that were made. The same dispersion analysis is used for 
small changes in launcher QE and payload weight if it can be shown that the area is not 
significantly affected by these changes. 

2.6.1.9. Required impact prediction data: 

2.6.1.9.1. In most cases, wind is the largest independent factor causing displacement 
of unguided vehicle impact points. The following data are required to predict the 
magnitude and direction of this effect: 

2.6.1.9.1.1. Ballistic wind weighting factors vs altitude in feet. The wind weighting 
factors should be presented in percent of wind effect for specific wind altitude 
intervals. The ballistic wind weighting factors should include both the effects of 
drift and weather cocking. Booster or first-stage wind drift effects are of prime 
importance since the booster and first stage motor impact point is usually near the 
launch site. 
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2.6.1.9.1,2, Change of the nominsl impact point due to missile weather cocking and 
drift as a result of ballistic winds {head, tail, side, or resultant Mind effect) in 
feet, nil) or ft per sec of wind. This data varies significantly with a change in 
launcher QE and, therefore, must be supplied in a table of launcher QE vs unit wind 
effect. The table must have a minimum interval of 2 degrees and include plus and minus 
12 degrees from the desired resultant QE up to a maximum launcher setting of 88 degrees. 

2.6.1.9.1.3 Launcher adjustment curves to correct the launcher in azimuth and elevation 
for wind effects. This data is required only if the user desires to adjust the launcher 
azimuth and elevation to correct for wind effects, and must be supplied for all desired 
resultant QEs. Kind compensation minimizes the area clearance problem by maintaining a 
constant impact point. A thorough description of the correction method and the expected 
accuracies to be achieved are required in addition to the proper curves and tabulation 
of data. 

2,6.1.9.1,4. A graphical and tabular presentation of the impact point displacement due 
to earth rotation vs QE. Calculations for this information are based upon the latitude 
of the launcher and the desired launch azimuth. The table must have a minimum interval 
of 2 degrees and include plus and minus 12 degrees from the desired resultant QE up to a 
maximum of 88 degrees. 

2.6.1.9.2. When a computer program is used to perform the calculation required for 
adjustment of the launcher in QE and azimuth, the Range user must include a discussion 
of the intended use of the program If the Range user wishes to use one of the computer 
programs available at the Range, consultation should be made with the Range to make sure 
that 2.6.1.9.1.! thru 2.6.1.9.1.4 above, are presented in a form compatible with the 
necessary computer input. 

2.6.1.9.3. The tabulations and charts of 2.6,1.9.1,1, 2.6,1,9,1,2, and 2.6.1,9,1.4 
above, are accompanied by a comprehensive discussion of their formulation and an example 
of their use. 

2.6.1.10. If any fragments, such as spin motors or hatch covers, etc., are ejected from 
the vehicle during any portion of the flight, there must be a complete description of 
the ejection conditions and associated impact dispersion area. 

2.6.1.11. All analyses for long-range probes [500 nm plus) must be calculated using a 
rotating spherical or ellipsoidal gravity field. Long-range probes, in contrast to the 
majority of probe vehicles, normally require a destruct system that is incorporated in 
an unguided vehicle. The data requirements are the same as those specified for guided 
ballistic missiles. If it can be shown that a destruct system is unnecessary for some 
long-range probes when launched from a definite geographical position with specific 
launch parameters, an impact probability study shall be submitted according to paragraph 
2.2.4. 

2.6.1.12. If an air-launch of a small rocket is desired, the following specific data 
are also required: 

2.6.1.12.1. Type of launch aircraft. 

2.6.1.12.2. Launch QE. 

2.6.1.12.3. Launch velocity in ft per sec or Mach number. 

2.6.1.12.4. Launch altitude in feet. 

2.6.1.12.5. Flight azimuth. 



2-28 WSMCR 127-1 IS Hay .1985 

2.6. U2. 6, Geodetic latitude and longitude of the expected drop point. In addition to 
the expected drop point, the maxim region around this point where drop could occur 
should be defined. This is provided in distances downrange, uprange, and crossrange 
relative to the expected drop point or by providing the geodetic latitude and longitude 
of the comers of the drop box. 

2.6.1.12.7. For launchers other than level flight, a wn'teup on the method of 
determining the launch QE and launch azimuth for vehicle release. 

2.6.1.12. 8. Nominal flight profile for each stage from launch to impact, showing 
altitude in feet vs downrange in feet, with timing marks in seconds indicated on the 
profile. Profiles must be included for all ununited or nonseparation conditions of the 
vehicle. 

2.6.1.13. Summary of past vehicle performance giving number launched, launch location, 
number that performed normally, behavior and impact for any that malfunctioned, and 
nature of malfunction and corrective action. 

2.6.2. The following trajectory data are required for the nominal trajectory for each 
desired nominal QE angle and payload weight, from launch until burnout of the final 
stage. These data must be provided in a tabular form with the independent variable, 
time in seconds, appearing on each sheet and with each column of the table containing 
only a single parameter. This table is a direct printout from the computer used to 
calculate the trajectory; however, it must conform with the table format specified. A 
definition of symbols must accompany each set of data. Time must be given at even 
intervals, not to exceed one second increments during thrusted flight, and for times 
corresponding to ignition and thrust termination or burnout of each stage. 

2.6.2.1. Velocity in ft per sec vs time of flight. 

2.6.2.2. Altitude in feet vs time of flight. 

2.6.2.3. Ground range in feet vs time of flight. 

2.6.2.4. Flight path angle of the total velocity vector in degrees vs time of flight. 

2.6.2.5. Coriolis displacement of the impact point should be presented, if it has been 
omitted in the trajectory data calculations. 

2.6.2.6. In addition to the tabular nominal trajectory information, the following 
characteristic vehicle data are required in graphical format: 

2.6.2.6.1. Impact range vs launch elevation angle for each stage and payload (nm vs 
deg), 

2.6.2.6.2. Apogee altitude vs launch elevation angle for each stage and payload (ft vs 
deg). 

2.6.2.6.3. Ground range vs altitude for each stage and payload (nm or ft vs ft). 

2.6.3. A statement of vehicle performance is required within one to three months after 
a vehicle test has been conducted. This information may be provided by writing a letter 
or by loaning W5MC/SE the performance evaluation documents prepared for other purposes. 

2.6.3.3. Qualitative statements about the performance of each stage and the various 
subsystems. 
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2.6.3.2. Failures that occurred and resulting flight conditions produced. 

2.6.3.3. Probable cause of failures and corrective action taken. 



2.6.3.6. Actual launcher azimuth and elevation setting (degrees). 

2.6.3.6. Predicted range (nm) and azimuth [deg) from the launcher to the 
impact point for each stage and payload. The predicted range and azimuth is 
based upon the predicted winds at time of launch. 

2.6.3.7. Actual range (■) and azimuth (degl from the launcher to the impact 
point for each stage and payload. 

2.6.3.8. Actual impact range components (nil) for each stage and payload 
measured along and perpendicular to the predicted impact azimuth. Where a 
stage is not tracked to impact, the impact point is computed using the best 
estimates of the drag characteristics and of the winds at launch. 

2.6.3.9. Predicted effective QE (deg) of trajectory for each stage. 

2.6.3.10. Actual effective QE (deg) of trajectory for each stage. 

2.6.3.11. predicted range (rail and altitude (ft) of apogee for each stage. 

2.6.3.12. Actual range (nm) and altitude (ft) of apogee for each stage. 

2.6.3.13. A tabulation of the reduced wind data used to make the launcher setting 
calculations giving speed (ft or sec) and direction (deg) as a function of altitude (ft). 

2.6.3.14. A reference list of all documents, graphs, and tabulations used to make the 
launcher setting calculations, that is, wind weighting curves, ballistic wind weighting 
factors, unit wind effect, tower tilt factor, etc. 

2.6.3.15. Source of tracking data. 

2.7. Aircraft Drop Data Requirements, The data requirements set forth under this 
heading apply to all nonpropulsive objects dropped hallistically or by parachute from an 
aircraft. Lead time requirements are listed in paragraph 2.3. 



2.7.1.1. General information concerning the purpose of the test, description of the 
object, and the type of data that are obtained. 

2.7.1.2. Geodetic latitude and longitude of the desired drop point and impact point. 
In addition, the maximum region around these points where drop or impact could occur 
should be defined. This is provided in distances domrange, uprange, and crossrang,e 
relative to the expected drop point or by providing the geodetic latitude and longitude 
of the corners of the area. 

2.7.1.3. Cn vs Bach number, reference area, and weight of object being dropped. The 
distance traveled in the horizontal direction from the point of release to impact can be 
supplied instead of the drag information. 



2.7J.4. The effect on the location of the impact point due to winds blowing in the 
direction of drop and perpendicular to the direction of drop is specified as distance 
per knot of headwind or crosswind. 

2.7.1.5, Three sigma dispersion or circular error probability (CEP) of impact point. 
If pilot error is not included in this dispersion, provide as a separate dispersion. 

2.7.Z. Flight plan of the drop aircraft. This includes the altitude of the aircraft, 
true air speed, and dive angle beginning 60 seconds prior to drop and continuing through 
drop. The required profile trajectory of the drop is in altitude in feet vs downrance 
distance in feet. Trajectories are included with parachute opening and with parachute 
not opening. Timing marks in seconds are indicated on the trajectory, a, well as total 
tine of flight for each object dropped. 

2.8, Aircraft and Ship Sensor Support Plan Data fiequirecents. For uissile launch or 
reentry operations requiring support aircraft or ships, the followig additional 
information is required; 

2.8.1. Aircraft Flight Profile Information: 

2.8.1.1. The following information Bust be submitted to HSHC/SEY at least 33 calendar 
days before the intended operation. 

2.8.1.1.1. Type of aircraft. 

2.8.1.1.2. Call sign ("H" nudier, tail nuEber, etc.). 

2.8.1.1.3. Final staging and recovery base. 

2.8.1.1.4. Warning area and mission area penetration (entry and exit) point(s). 
2 8.1.1.5. Holding fix(es) and altitudes). 



2.8.1.1.7. Maneuvering after ISP for departure to recovery base. 

2.8.1.1.8. A copy of information supplied in Federal Aviation Agency (FAA) and other 
required flight plans for controller background information. 

2.8.1.2. A copy of information, both written and graphic describing the data gathering 
maneuvers to be conducted while operating in an area controlled by the supporting Range. 

2.8.1.3. Prior to the start of the operation, each aircraft comander receives an 
operation identifier, for example, operation number, that must be included in the FAA 
flight plan remarks section at the time of filing, 

2.8.2. Ship Cruise Profile Information: 

2.8.2.1. The following information must he submitted to USMC/SEY at least 30 calendar 
days before the intended s 



2.8.2.1.1. Class of ship. 

2.8.2.1.2. Call sign (registration number, name, etc.). 
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2,8,2.1,3, Final staging and recovery point. 

2*8.2. 1*4. Warning area and mission area penetration (entry and exit] point(s). 

2.8.2.1.5. Holding fix(es), 

2.8.2.1.6. Course and speed to the test support position {TSPJ, that is, terminal end 
of the data run. 

2.8.2.1.7. Maneuvering after TSP for departure to recovery point. 

2.8.2.1.8. A copy of inforsation supplied in sailing orders for controller background 
information, 

2.8.2.2.. A copy of information, both written and graphic, describing the data gathering 
maneuvers to be conducted while operating in an area controlled by the supporting range. 

2.9. West Coast Offshore Operating Area (HTOOA}: 

2.9.1. General infanaation concerning the nature and purpose of the flight. In 
addition to the itess required in paragraph 2.8, the following iteas are required for 
aircraft flight: 

2.9.1.1. List associated aircraft (chase, tanker, etc.) by type(s) and ■K* or tail 

runners. 

2.9.1.2. Specify Qinimuia weather requirements for test operations. 

2.9.1.3. Specify special ecargency requirements. 

2.9.1.3.1. Search and Rescue {SAR) support requireEents. 

2.9.1.3.2. Emergency Recovery Plan. Include tainiEtss field length(s), 

2.9.1.3.3. DesTibe ditching characteristics, if known. 

2.9.1.3.4. Describe secondary canamication procedures to be used in the event of 
primary communications failure. 

2.9.1.3.5. If structural flight and systems tests are to be conducted, specify any 
weather linimuins and special requirements, 

2.9.1.3.6. A sonic boom report is required if sonic boom testing is to be conducted in 
compliance with AFR 55-34, Reducing Flight Disturbances, and file AF Form 121, Sonic 
Boom Report. 

2.9.1.3.7. For environmental assessment, comply with AFR 55-34 and AFR 19-2, 
Environmental Inpact Analysis Process (EIAP). 

2.9.1.3.8. Range users should comply with WSHCR 55-7, Aircraft and Aeronautical Systems 
Testing on the WCODA* 

2.9.2. For SABER, three types of input data are required. These are control 
information, NFS data, and flight profile data. 

2.9.2.1. Control information required; 
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2.9.2.1.1. R - distance f™ aircraft where NFS is determined, in feet, 

2.9.2.1.2. LH - length of nodel of vehicle in feet. 

2.9.2.1.3. LR - vehicle aircraft length in feet. 

2.3.2.2, NFS data: 

2.9.2.2.1. (theta) - roll angle, in degrees. 

2.9.2.2.2. fl - Mach No. 

2.9.2.2.3. K - number of points in NFS. 

2.9.2.2.4. X - Aircraft station on jaodel wnere pressure perturbation was measured i 
feet. 

2.9.2.2.5. Delta P/P - pressure perturbation divided by anbient pressure. 

2.9.2.3. Flight profile data: 

2.9.2.3.1. Tisie (seconds). 

2.9.2.3.2. Vehicle altitude (feet) above reference spheroid. 

2.9.2.3.3. Geodetic latitude (degrees) of vehicle. 

2.9.2.3.4. Longitude (degrees) of vehicle. 

2.9.2.3.5. Vehicle freestreaa Hach majber. 

2.9.2.3.6. Vehicle flight path angle (degrees) measured up frora horizontal. 

2.9.2.3.7. Yehide heading (degrees) from, true north. 

2.9.2.3.8. F! dot - The tiae rate of change of Hach nuEiber (1 second). 

2.9.2.3.9. Ticie rate of change of flight path angle (degrees or second). 

2.9.2.3.10. Tine rate of change of heading (degrees or second). 



2.10. Directed Energy Systems. The data requirements set forth under this heading 
applies to all forms of directed energy system testing. These systems include, but are 
not limited to, lasers, neutral and ion beans with any combination of surface, air or 
space for the energy source or target. Lead time requirements are listed in paragraph 
2.3, however, some systems may require more advanced lead time. 

2,10,1, The fjllowing data are required for each test or group of tests. Additional 
data may be required depending on the system, being tested, 

2.10.1,1, General information concerning the purpose of the test, description of the 
system, and the type of data that is obtained. 
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2.10.1,3. The type of prisary and secondary radiation, if present. The effect of the 
radiation, permissible exposure levels, hazardous range, both endoatmospheric and 
exoatmosphenc. 

2.10.2, The trajectory of the energy source, the beam, the target, and timing are 
required. 

2.10.3. Coordination with Space Defense Operation Center (SPADOC) is required for 
systems that may present a hazard to a spacecraft. For these systems, test day 
coordination xith SPADOC will be required to verify clear range. A test plan will be 
developed by the range user and exercised prior to test day to verify tisely operational 
control. 
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Chapter 3 
SYSTEM GROUHD SAFETY 
3,1, System Ground Safety Introduction: 

3.1.1. This chapter encompasses policy, responsibility, unique design, and data 
requirements for system and design safety, including the prelaunch portion of missile 
and space operations. Data submittals and procedures are defined for obtaining safety 
approvals and HSSSA for ground processing, launch, and recovery of aissile systems. 

3.1.2. The chapter identifies the system safety policies and requirements that are to 
be implemented by the user and Goverrment sponsor. Satisfactory deaonstration or 
evidence that these requirements have been net is a user responsibility. Actual 
iinpleaentation is delegated to a contractor activity, but failure of a contractor to 
cociply, or failure to provide contractual direction, does not relieve the sponsor of the 
responsibility. The Governnent sponsor must make sure that the responsibility is 
inplenented. Tailoring of these requirements nust be coordinated with HSMC/5E. 

3.1.3. It is the responsibility of all users to provide for the safety of their 
systeos. Coopliance with requireoents of this chapter provides the level of safety 
required for design and systea processing. Mishap risks can be irrffcpendently accepted 
by the user only when the effects of the nishap are contained totally within user- 
controlled resources. If the effect of a nishap generates dasage across an interface to 
resources under the control of another agency, nishap risks are accepted only with the 
concurrence of the affected agencies and the highest rcanageneitt authority participating 
in the operation. 

3.1.4. It is the responsibility of the user to independently verify and present 
evidence to WSKC/SE that safety requirements are lnpleiented. This presentation 
identifies methods used to effectively control nishap risk, within the parameters 
specified by this chapter, for review by KSHC/SE. Acceptable verification cethods 
include design specifications, engineering drawings, control procedures, documented 
inspections, and test results. HSflC/SE iwst be assured that user operation does not 
present a hazard that will injure personnel or cause damage to HSHC property. 

3.2 System Safety Program: 

3.2.1. An analysis program, such as described in HIL-STD-1574A, will he conducted for 
each system operated at HSHC. The criteria of this chapter coaplements the system 
safety criteria contained in HIUSTD-1574A and will be implemented in system design and 
system safety analysis. 

3.2.2. A System Safety Program Plan (SSPP) DI-H-7047, will be prepared according to 
H IL-STD-1 57 4A , describing the safety program for installation and operation of the 
system at VSHC. The SSPP will depict the aspects of HIL-STD-1574A and the Accident Risk 
Assessment Report that are pertinent to the program. h'SHC/SE will be provided copies of 
the SSPP with the initial request according to hIL-STO-1 574A, describing the safety 
program for installation and operation of the system at WSMC, HSHC/SE will be provided 
copies of the SSPP with the Initial request for Range use. 

3.2.3. USHC/SE must have representation in the system safety groups formed by hardware 
and software design agencies for systems to be used at WSHC, notice of technical 
interchange meetings and program reviews (PDR, CDR, etc.) will be provided to h'SHC/SE. 
WSHC/SE representatives will attend the meetings of interest on a selective basis. 
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3.2.4. The user must establish procedures for identification and tiraely action for 
eliminating or controlling hazardous test conditions induced by design deficiencies, 
unsafe acts, or procedural errors. Procedures must be established to identify, review, 
and supervise hazardous high risk tests, including tests performed specifically to 
obtain safety data. The user's system safety organization must; 

3*2,4.1, Review and approve test plans, procedures, and changes to verify safety 
requirements identified by the system analysis are incorporated. 

3.2.4.2. Hake sure an assessment of accident risk is included in all pretest readiness 



3.2.5. Users must provide a Launch Complex Safety Plan (LCSP) according to chapter S. 

Payioad organizations noroally supplement existing plans. 

3.2.6. The user's systems) sust be designed to tolerate s nuE&er of credible failures 
or operator errors as determined by the degree of hazard involved in the operation(s). 
All sequences, procedures, or functions which operate under computer control shall be 
designed in such a Banner that a critical failure code or error condition will result in 
the systeo reverting to a known safe state. 

3.2.6.1. Ordinary operations are those having aishap potential, but noraal industrial 
safety practices are sufficient to prevent mishap occurrence. {Design safety factors 
for slings, hoists, cranes, etc, are considered sufficient protection,) During 
ordinary operations* all system Bust resain at least two failures fros a class 8 eishap 
[single-fault tolerant) and three failsres from a class A sishap (two-fault tolerant). 

3.2.6.2. Ho single failure, or operator error, should result in damage t* equipment, 
injury to personnel, or the use of contingency or eiargency procedures (class 8 aishap, 
or less, as defined in APR 127-4, Investigating and Reporting US Air Force Mishaps). 
Operations that could result in a class 3 aishap sust have at least two independent 
inhibits in place during all periods when the potential for aishap exists. Loss of one 
inhibit requires suspension of the operation until the inhibit is restored. Analysis 
Gay show that Halted exposure of personnel is reasonable and prudent when one inhibit 
has been removed and the likelihood of failure of the renaming inhibit is reuote. If 
this exposure is permitted, the operation is designated as a type 8 hazardous operation 
and all personnel not essential for conduct of the particular task are evacuated. 

3.2.6.3. Ho combination of two failures or operator errors should cause a fatality or 
result in major damage [class A raishap as defined in AFR 127-4). Operations that could 
result in a class A mishap must have at least three independent inhibits in place during 
all periods when the potential for mishap exists. Loss of one inhibit requires 
suspension of the operation until the inhibit is restored. Analysis may show that 
limited exposure of personnel is reasonable and prudent when one inhibit has been 
removed and the likelihood of failure of the remaining inhibits is remote. If this 
exposure is permitted, the operation is designated as a type B hazardous operation and 
all personnel not essential for conduct of the particular task are evacuated. If 
analysis shows exposure is not reasonable and prudent when one inhibit has been removed 
or if two inhibits have been removed, all personnel will be evacuated fros the hazardous 
area. In this event, the operation is designated a type A hazardous operation. 

3.2.7. As part of the accident risk factor identification and control matrix in the 
Accident Risk Assessment Report (ARAR), users will apply definitions of hazard 
categories as follows: 



3.2.7. L Category III hazards exist in conditions where the worst case potential effect 
is less than category I or II hazards described below. 

3.2.7.2. Category II hazards are those that could result in: 

3.2.7.2.1. Personnel injuries. 

3.2.7.2.2. Damage to launch sits equipment or facilities or launch vehicle payload. 

3.2.7.2.3. Conditions that result in a system being one event (failure or human error) 
away from a category I hazard, 

3.2.7.3. Category I hazards are those that could result in: 

3.2.7.3.1. Loss of life. 

3.2.7.3.2. The loss of aajor systems such as missile, payload, a launch facility, o- 
support facility. 

3.2.7.3.3. Missile impact outside the hazard corridor. 

3.2.8. Sesidual hazards are conditions that retain the potential of causing injury to 
personnel, or damage to equipment, after intended design or other control actions have 
been inpleaented to reduce the probability and consequences, 

3.2.8.1. Hazardous operations are those that contain category II residual hazards. 
Such hazards could iesa!t in class 8 mishaps. 



3.3. H 

3.3.1. All ground support equipment (GSE), facilities, missile and space systems, 
critical software modules, computer controlled test equipment, computerized maintenance 
scheduling systems, and modifications to these systeas for all hazardous operations must 
be reviewed and receive safety approval for use at HSKC. To obtain approval; users must 
meet the requirements of this regulation. MSGSA is the approval means for operation of 
any missile and space vehicle at HSflC. Formal HSGSA is granted after all data 
submittals have been received, reviewed, and approved. 

3.3.2. Nhen proposed missile and space vehicle systems are approved for operation, the 
launch agency is given a HSGSA specifying the conditions of approval and the particular 
vehicle(s) the approval applies to. The approval is effect™ as long as the designated 
systeas remain in the specified limits. HSGSA constitutes approval for hazardous ground 
operations up to and including launch. HSGSAs are not repetitive. A HSGSA is required 
prior to each launch of a continuing program. Certification that the system configur- 
ation has not changed is required prior to the fssunce of each HSGSA, or the changes 
must be submitted as a part of the request for HSGSA. 

3.3.3. An flRAR provide', verification of safe systei design and planned safe operation. 
It is the basis for issuance of the HSGSA. The ARAR is prepared according to Data 
Information Description (DIB) DI-S-30565A, The user and tovernment sponsor coordinate 
the delivery schedule with BKC/SE. The ARAR is required 30 days prior to conduct of 
hazardous or dangerous operations; 120 days if radioactive sources are to be used. A 
minimum of one copy of the ARAB is provided to USHC/SEi more are required if the program 
size involves several safety offices. The Range user is responsible for providing 
required data regardless of the extent of contractor support. 
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3.3.3.1. Brief descriptions of the booster system, payload sjstea, software control 
system, and any other system raust be provided in the ARAR introduction. Brief details 
of the hazardous subsystems mist be provided in the ARAR appendices, 3.3.3.3 below. 
Safety requirements for support equipment are identified. Support equipment safety 
design criteria must be incorporated in the segment specifications. Special attention 
■St be given to the planning, design, and refurbishment of reusable support equipment 
including equipment carried on flight vehicles to make sure safety is not degraded by 
continued usage. Identified requirements for support equipment must be equal to, or 
better than, those specified by Federal and Air Force Occupational Safety and Health 
(AFOSB! Regulations. 

3.3.3.2. The user shall inform KSHC/SE of all hardware or software changes, modifica- 
tions, and new systems that have a safety implication. The notification must be made at 
least 30 days prior to initiating actions for modifications or changes to existing 
approved programs; at least 90 days prior to bringing a new program or major system to 
HSNC; and at least 120 days prior to use of radioactive materials at KSHC. 

3.3.3.3. Descriptions of ARAR appendices are as follows. The user's documentation 
should incorporate one or more of the following system appendices; if not utilized, a 
negative response is required in the ARAR- 

SSE and Facilities * Section 3.5 

Handling Equipment - Section 3.6 

Noise Protection - Section 3.7 

Son-Ionizing Radiation - Section 3.8 

Ionizing Radiation - Section 3.9 

Toxic Haterials - Section 3.10 

Propellent and Propulsion Systems - Section 3.11 

Pressurized Systems - Section 3,12 

Ordnance Systems - Section 3.13 

Electrical and Electronic Systems - Section 3,14 

Software/User-System Interface (IIS) - Section 3.15 

3.3.4. The safety requirements established in this regulation provide many design 
solutions to hazardous conditions. They apply generally to all systems operated at 
WSMC. Safety analyses may show alternate methods of hazard control more appropriate to 
a specific system design. Such alternate methods can be coordinated for approval with 
WSK/SE during design reviews. 

3.3.5. Attachment 2 is a listing of reference documents for safe design considera- 
tions. They are sources of information for requirements to be used in the system design 
and development of the ARAR. They should be used as much as possible and in conjunction 
with other recognized codes and standards. Clarifications of conflicting requirements or 
questions of tailoring are submitted to HSHC/SE for interpretation and final resolution. 

3.4. Missile Systems and Missile Operations: 
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3.4.1. A brief description of the missile booster system must appear in the ARAR 
introduction, and brief details of the hazardous subsystems must appear in the 
appropriate ARAR appendices. If the program is repetitive in nature, subsequent ARARs 
may refer to the original ADAS and detail only those items or systems that are new or 
changed. A HSGSA is not repetitive, each launch of a system requires a separate MSGSA 



3.4.2. Hazardous and dangerous missile processing, prelaunch, and launch operating 
procedures require WSMC System Safety approval. A description of missile processing 
must appear as part of the ARAR under the procedures section, as well as descriptions of 
system processing. The information contained in hazardous operating procedures will be 
as specified in paragraph 5.4.3,3. These procedures must be submitted to HSHC/SE for 
review and approval at least 30 days prior to beginning of operations. 

3.4.3. Space Shuttle payload operations must utilize the Space Transportation System 
Payload Ground Safety Handbook, SAMTO HB S-100 (available from SAMTO/00}. Space shuttle 
payload design must conform to safety requirements cited in IIHB 170Q.7A. 

3.5. GSE and Facilities: 

;ile systems, explosive siting, design, and 



3.5.1.1. Facility construction plans involving design, construction or modifications 
performed on AFSC facilities must be approved by HSHC/SE prior to start of construc- 
tion. The range user or Base Civil Engineering must submit a preliminary hazards 
analysis with the plans to HSHC/SE. Review, coordination, and approval of support 
facilities, or missile systems, and modifications to then normally require a lainimum of 
30 days. 

3.5.1.2. AFR 127-100, Explosive Safety Standards, will be used for planning, siting, 
constructing, operating^ modifying, or relocating any ordnance, propellant, hazardous 
assembly and checkout, or launch complex facilities at VSfE. KSflC/SE must approve all 
quantity-di stance (00) site plans or proposed facilities that fall within proposed or 
existing explosive safety clear zones. Facility explosive quantity distance siting 
requires a mim'iM of 120 days for the review and approval processing cycle. 

3.5.2. WSMC/SE may elect to participate in government buy-off of facilities. 

3.5.3. Provide fire-protection systems according to sound economical and engineering 
practices to make sure the proper degree of fire protection for the isission and risk 
according to a planned program to further protect life and property. Fencing 
encompassing facilities where hazardous operations are performed raust have emergency 
egress gates approved by HSHC/SE. 

3.5.3.1. Use an agent application method and extinguishing agent that are both 
compatible and effective for the anticipated hazard. 

3.5.3.2. System restoration time should be minimal in critical protection areas with 
repeat application capability or system redundancy considered as design objectives. 

3.5.4. Air Force 08 series documents are the prime source for design direction; other 
Government and national consensus standards and specifications are secondary sources for 
facilities used in the storage, assembly, checkout, prelaunch, and launch of ordnance 
for missile space vehicles and payloads. 
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3,5,5, AFR 127-100 will be used for planning, siting, constructing, operating, 
modifying, licensing, or relocating any ordnance propellant, hazardous assembly and 
checkout, or launch complex facilities at WSflC, HSHC/SE must approve all QD site plan 
or proposed facilities that fall within proposed or existing explosive safety clear 



3.5.6. Once hazardous systems are approved, their components and interfaces with other 
systems must not be modified without prior WSMC/SE approval. If modifications are made 
without prior coordination, SE approval is automatically revoked. The procedure for 
obtaining approval For modification is the same as for a new system. Changes must 
conform to current safety requirements at the time of the change and not necessarily to 
the requirements of the original design. 

3.5.7. Special hazardous operations (those not directly associated with missile test, 
HSHC operations, or normal HSMC operations and maintenance (Offl) functions, but 
employing WSHC resources) will be conducted using an approved test plan or special test 
procedures. The proposed test plan or special test procedures must he submitted to 
WSKC/SE for approval. Those operations that rtquire services of other Air Force 
commands or federal agencies may require review and approval by the organization 
providing the service. Such approval is also coordinated through HSHC/SL 

3.5.8. All changes to previously approved hazardous procedures require WSHC/SE approval. 

3.5.9. When an operation could cause damage to equipment, injury to personnel, or 
degradation of system functions, particular attention must be given to controls. 

3.5.9.1. Operation of controls that initiate hazardous operations require prior 
operation of an associated or locking control* When practical, the critical position of 
such a control activates a visual and auditory warning device in the affected work 
area. Public address (PA) announcements are mandatory for the start of hazardous or 
dangerous operations and should be used to terminate safety control areas when opera- 
tions are complete. 

3.5.9.2. Deadman controls must be utilized when operator incapacity can cause an 
immediate safety-critical system condition. 

3.5.9.3. Systems must have sufficient assistant operators or spotters to make sure that 
all sides of the system are clear for operation. All operators or spotters must have 
aural communications available for coordination between themselves when power is on the 
system. 

3.5.9.4. If system movement could be critically hazardous from the view of a spotter or 
assistant operator, an emergency stop capability must be available at each such view- 
point. 

3.5.9.5. For systems where concurrent commands can be made, priority is provided for 
the superior command, or the control station must be provided with a disconnect or key 
lock-out feature. The lock-out feature must not preclude the emergency stop capability. 

3.5.10. Lifeline or lanyard anchor points: 

3.5.10.1. The following is provided for determining the adequacy of anchorage points 
for lifelines, lanyards, 1 or droplir.es and is based on criteria established in ANSI 



3.5.10.2. The anchor points shall be capable of withstanding a deadload of 5400 lbs to 
yield for each user of the anchor point. 
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3.5.10.3. The integrity of anchor points shall be determined by design analysis or by 
acceptance of vendor design specifications, If these methods are not possible, or the 
quality of fabrication is in question, the anchor points shall be proofload tested to 
2160 lbs for each user of the anchor point. 

3.5.10.4. Design analysis and proofload shall consider all possible vectors of the 
forces induced by fall. The design analysis or proofload shall he repeated if the 
anchor point becomes damaged, modified, or repaired. 

3.5.10.5. The anchor points shall be stenciled or tagged with the maximum number of 
persons and total weight allowed to be attached to the anchor point at a given time. 

3.5.10.6. The anchor points will be located as high as practical to limit the distance 
of potential fall, 

3.5.10.7. Fixed anchor points shall be located so that they do not endanger fluid or 
gas lines, electrical cabling, critical hardware, or flight components when the lifeline 
or lanyard is attached, in use, or under load. To preclude the above conditions, 
shielding or guarding of the components or systems in question nay be required. 

3.5*10.8. Anchor points other than those existing and designated nay be approved if 
they are verified to comply with the above criteria. Additional fixed anchor points may 
use existing structures which coeply with the stated requirements stated here when 
approved by WSMC/SE. 

3,6. Handling Equipment: 

3.6.1. Validation tests will be accomplished on all elevators according to the 
requirements of the American national Standards Institute (ANSI) A17.1 and ANSI A17.2 } 



3.6.2. The following applies to forklifts used for handling critical loads: 

3.6.2.1. The design must provide for proof testing to 125 percent of rated load. 

3.6.2.2. If the forklift is for operation outside, a tire size capable of negotiating 
the expected ground terrain is needed. The forklift should be capable of "field 
stacking." 

3.6.2.3. Diesel and gasoline powered forklifts must have the following features: 

3.6.2.3.1. Exhaust system spark arrestors. 

3.6.2.3.2. Tight-fitting caps on the fuel-fill pipes. 

3.6.2.3.3. A deflector plate to prevent fuel overflow froa hitting motors or exhaust 
components. 

3.6.2.3.4. Fuel line valves, installed at fuel tanks for emergency flow shutoff, and 
flash screens in the fill lines. 

3.6.2.3.5. Special fuel line vibration-protective devices must be tested for rupture 
under normal operating conditions. 

3.6.2.3.6. Electrical connections designed to preclude accidental disconnection during 
noraal operation of forklifts. 
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3.6.2.3.7, Exhaust gases from any motor must be emitted at least six feet away from any 
ordnance loads. 

3.6.2.3.8. On-board fire e^ttnguisher* must be provided for use on class B fires. 
3.6.2.4. Battery-powered fork lifts must meet the following criteria; 

3.6.2.4.1. Electrical cables must be routed so they cannot catch or snag on stationary 
objects. Cables must be protected from short circuiting. 

3.6.2.4.2. Battery boxes must be securely fastened and sufficient ventilation provided 
to assure an explosive-gas-mixture does not develop. Vent openings are designed to 
prevent direct access to the cell terminals from the outside. 

3.6.2.4.3. Forklifts must be equipped with a deadman switch and the main service switch 
must be located so it can be operated from the driver's position. 

3.6.2.4.4. The battery-powered units designated "EE" or "EX" must be used in locations 
where volatile, flammable liquids or gases are handled, processed, or used, 

3.6.3. Vehicles used for transporting explosive, toxic, or hazardous materials must 
comply with Department of Transportation (DOT) regulations. 

3.6.3.1. Motor vehicles or equipment with internal combustion engines used for 
transporting exposed explosives {including explosive scrap, waste, or items contaminated 
with explosives) must be equipped with exhaust system spark arrestors and carburetor 
flame arresters (authorized air cleaners). 

3.6.3.2. Vehicles with internal combustion engines, operated within a no smoking area, 
propellant holding area r or pad deck involved in missile servicing during or after 
propellant loading, or during Solid Rocket Motor (SRM) stacking, must be equipped with 
spark arrestors and carburetor flame arrestors (authorized air cleaners). 

3.6.4.. The handling equipment section of the ARAR should list the design proofload 
criteria for all transportation and handling equipment according to chapter 5. 

3.7. Boise Protection: 

3.7.1. Noise protection design for operator personnel is implemented according to 
criteria outlined in AFSC DH 1-3, MIL-SFD-1472C, and AFR 161-35, Hazardous Noise 
Exposure, Objectives of hearing protection in facility designs are to minimize short 
and long term hearing loss, increase task efficiency, improve connunications, and reduce 
operator fatigue, 

3.7.2. The user must include, as part of the ARAR, the location of all noise source 
fields that may result in hazardous noise exposure for personnel. The user must include 
data on the operating acoustic level and characteristics of systems or subsystems such 
as hydraulics, power units, and similar high energy noise producing systems when they 
exceed 84 decibels/A scale { clBA ) . 

3.7.3. When individuals are exposed two or more times in a given workday to noise 
fields different in level for a different time interval {the duration of the interval of 
a specific noise level being less than the limiting duration), tfie acceptability of such 
multiple exposure to unprotected personnel can be calculated as follows {AFR 161-35); 

3.7.3.1. For each separate noise field, construct a fraction by dividing the daily 
duration of the noise field at its specified noise level by the limiting daily duration 
at that specific noise level, 



MSHCR 127-1 IS Bay 1985 3-9 

3.7.3.2. Add the fractions for all noise fields. 

3.7.3.3, if the sum of the fractions is one or less, the exposure level is acceptable. 

EXAMPLE: One noise field at 80 dBA for 8 hours, a second noise field at 88 dBA for 1 
hour, and a third noise field at 100 d!» for 10 r.inutes. The sum would be 8/16 + 1/4 * 
1/3 = 13/12. Since the fraction is greater than one, the limiting value is exceeded and 
the mixed exposure is unacceptable. If the duration of the noise field at 100 dBA nere 
reduced to 7.5 minutes, sum would be 8/16 <■ 1/4 + 1/4=1 and the mixed exposure would 
be acceptable. 

3.7.4, A method of protection must be provided for personnel who are exposed to sound 
pressure levels above 84 dBA in any octave band for continuous daily exposure of 8 hours 
per day, 40 hours per week. AFR 161-35 serves as the guide for determining the 
effectiveness of protection equipment and methods. Unprotected noise exposure should 
never exceed 115 dBA for any exposure period. No one should be exposed to noise levels 
that exceed 350 dBA no matter how much the noise level in the ear canal has been reduced. 

3.8. Non-Ionizing Radiation: 

3.8.1. Radio Frequency (RF) Systems producing RF radiation, must be designed so the 
hazards presented to personnel are at the lowest practical level. Personnel exposure to 
radiation must not exceed the permissible exposure levels of 10 milli-watts/sq. cm. or 
as defined in AF0SH SID 161-9. 

3.8.1.1. When feasible, interlocks should be utilized to prevent unnecessary exposure 
of personnel to hazardous areas. Interlocks must be utilized in areas where electrical 
radiation hazards would be present if protective coverings were removed. 

3.8.1.2. Appropriate "fail-safe systems" will be incorporated so that accidental 
operation of RF emitting systems is prevented. 

3.8.2. A list of all radiating sources within launch complexes and ground processing 
locations will be provided with the information required by AF0SH STD 161-9'. 

3.8.2.1. Hhen RF radiating equipment is to be introduced into range environments, a 
facility siting hazard analysis must be accomplished according to AFR 1U-6, 
Electromagnetic Interference and Radiation Hazards, AF0SH SID 161-9, and TO 31Z-10-4. 
This analysis must be submitted to BKC/SE for review. Test acceptance approvals may 
include a field survey of the RF power density. A copy must be posted at each facility 
and two copies will he forwarded to WSUC/SE for file and distribution. 

3.8.3. Laser system designs must incorporate requirements of AFSC DH 1-6 and AFOSH 5T0 
161-10 or rationale must be shown for nonapplication. 

3.8.3.1, For areas where electrical or laser hazards would be present if protective 
coverings or proper eye protection were removed, interlocks must »-> utilized to prevent 
unnecessary exposure of personnel to laser hazards. 

3.8.3.2, Appropriate systems must be incorporated to prevent inadvertent or accidental 
operation. 

3.8.3.3, when toxic chemicals or cryogenic materials are utilized with laser systems, 
shutoff valves must be provided in locations to minimize leakage in the event of a line 
rupture. 
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3.8.3.4. L?ser systems must be designed so hazards to personnel and equipment are at 

the lowest practical level. All laser systems nusi conform to the laser health hazards 
control specified by AFDSJi SID 161-10. 



3.8.4.1. Laser specifications data sheet (including nomenclature), maximum and minimum 
power output, pulse durations, power measurements before and after optics, beam diameter 
with variations due to optics such as converging lenses, bean divergence angle, 
warnings, and fail-safe provisions. 

3.8.4.2. A hazard analysis addressing chemical, electrical, X-ray, optical and other 
related hazards. It must include the calculated Safe Eye Exposure Distance (SEED) data 
showing that permissible exposure level (PEL) is controlled and not exceeded, and the 
aspects and effects of weather, reflectivity, "hot spots," and ordnance considerations. 

3.8.4.3. Standard Operating Procedures (SOP) detailing operations, personnel and eye 
protection, and personnel access controls. 

3.8.4.4. Certification for laser systems installation and operation at WSMC must be 
implemented through the USAF Hospital Bioenvironnental Engineering Office 

(USAF Hospital /5GPB). 

3*9. Ionizing Radiation: 

3.9.1. Radioactive system or subsystems must conform to requirements of AFR 122-15, 
Nuclear Power System Safety Reviews and Surveys; tfR 122-16, Huclear Safety Review 
Procedures for Space or Missile Use of Minor Radioactive Sources; AFR 160-132, Control 
of Radiological Health Hazards; CFR Title 10; CFR Title 49; TO OQ-llOfi-2 and 3; and 
HIL-STD-1574A as supplemented. The Air Force Weapons Laboratory (AFWL) is responsible 
for conducting a technical nuclear safety evaluation (TnSE) using the Safety Analysis 
Summary (SAS) subletted by the user. This evaluation is the basis for HSMC approval. 
The request for TflSE mut be submitted through AFSC/IGF according to AFR 12M6. 

3.9.1.1, Huclear radioactive sources carried aboard missile or space vehicles must be 
compatible with, and have no adverse effects on, ordnance items or flight termination 
systems. 

3.9.1.2. Huclear radioactive sources aboard missile or space vehicles should be 
designed so they may be installed as late as possible in the countdown, particularly if 
personnel are required to work within controlled radiation areas (M/hr) while 
performing any tasks. 

3.9.1.3. Design and tasfc sequencing will be so that personnel exposure is as low as 
practicable and according to AFR 161-8, Control and Recording Procedures Occupational 
Exposure to Ionizing Radiation, CFR 10, and AFR 160-132. 

3.9.1.4, The system must be designed to minimize the radiological accident risk 
potential in the event of a launch facility accident involving the launch vehicle. The 
SAS must contain location estimates of the source and its physical characteristics 
(vaporizes, melts, etc). 

3.9.2. Two final copies of a SAS and Radiation Protection Plan (RPP), prepared 
according to AFR 122-16, Nuclear Safety Review Procedures for Space or Missile Use of 
Radioactive Sources, must be submitted to USMC/SE 120 days prior to arrival of the 
radioactive material atWSMC, A SAS is required regardless of security classification, 
If there are no radioactive sources associated with a program, a negative response is 



MSMCR127-1 15 May 1985 3-11 

required. Nan-Air force users ara required to certify that their flight approval 
requirenents have been net. Copies of their approval correspondence nust be provided to 
the eiC Radiation Safety Committee. 

3.9.2.1. Radioactive naterial or assemblies are handled under the supervision of a 
designated user or the Radiation Protection Officer named on the Nuclear Regulatory 
Commission (HRC) license or USAF permit. Applications for USAF permits must be 
submitted to the USAF Hospital/SGPB and must include a copy of the user's HRC license. 
The HRC licensee or contractor must submit three copies of the HRC license with the USAF 
permit to HSHC/SE at least 30 days prior to planned entry to WSMC. 

3.9.2.2. In addition to submission of procedures and ARAR approval action, field 
processing must be approved in writing by the WSHC Radiation Safety Committee. As a 
necessary step to obtain approval, the facility user will brief the WSHC Radiation 
Safety Committee on all hazards and procedures concerning the handling of their 
radioactive material at HSHC. A H5GSA can only be issued after receipt of written 
approval from the WSHC Radiation Safety Comittee. An approved environmental impact 
statement is a prerequisite for approval of the Radiation Safety Committee, 

3.9.2.3. The USAF Hospital/SGPB nust have access to the source to maintain appropriate 
records, perform routine surveys on handling procedures associated with each source, 
and, where necessary, perforn radiation surveys on the operational use of the naterial. 
These actions are accomplished under the surveillance of the Base Radiation Protection 
Officer in coordination with HSHC/SE. 

3.9.2.4. Notification procedures for entry and transportation of radioactive materials 
on VAFG are found in VAF6R 161-1, Control of Ionizing Radiation. 

3.10. Toxic Materials: 

3.10.1. All toxic or corrosive materials, chemicals, and propellant materials require 
the following information: 

3.10.1.1. A general description of the coaiodity in use, the hazardous qualities of the 
material, and data showing cottpliance with allowable limits for airborne vapors for 
workspace, workplace emergencies, and short term public exposures. 

3.10.1.2. As a minimum, annual air sampling must be accomplished in each workplace 
where exposure exceeds one-half the eight-hour timed weighted average PEL (AFOSH STD 
161-8}. 

3.10.2. A statement is required that personnel must not be subjected to concentrations 
greater than the threshold limit value [TLV1 under normal ci rcuistances. If an 
unplanned release of propellant or vapors occurs, all unprotected personnel must be 
evacuated. (TlV is the maximum allowable concentration (MAC) for an eight-hour day, 
five-day week of continuous exposure.) 

3.10.3. Detection equipment location, protective equipment, decontamination equipment, 
and neutralizes (nust be identified. The protective equipment description must include 
type, make and location of breathing apparatus, type of protective clothing ensemble 
required, and any special handling equipment required, with instructions for use. 

3.10.3.1. Respirators can be used to protect workers from exposures exceeding these 
PELs only under the following conditions (AFOSH STD 161-1): 

3.10.3.1.1. During the time period necessary to install engineering controls or 
institute practices. 
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3.10.3.1.3. During infrequent or nonroutine operations. 

3.10.3.1.4. During emergencies. 

3.10*3.2. The Base supporting medical facility is responsible for medical examination 
of personnel oceupat tonally exposed to the chemical substances listed in AFOSH SIB 
161-1, Control of Inonizing Radiation. 

3.10.3.3. If medical examinations are required, they should, as a miniraia, include: 

3.10.3.3.1. Baseline and periodic {at least annual) examinations* 

3.10.3.3.2. A complete medical and chemical exposure history. 



3.10.3.3.4. Only those diagnostic tests or clinical examination procedures required to 
detect changes in target organs of the chemical exposure involved. 

3.10.3.4. Only those itess of protective clothing and equipment that meet National 
Institute for Occupational Safety and Health (KIOSH), ANSI or Air Force accepted 
standards will be procured or accepted for use. WSHC/SE approval is required for all 
protective equipment used in support of all hazardous or dangerous operations. 

3.10.3.4.1. On-the-job indoctrination covering hazards, safe practices, hazard 
reporting, personal cleanliness, and the use and care of protective items is accom- 
plished by the supervisor. This training must be accomplished according to AFR 127-12, 
Air Force Occupational Safety and Health Program, and records maintained by the 
supervisor, 

3.10.3.4.2. Functional managers, *ith assistance from safety or bioenviraimenta! 
engineering personnel, determine which jobs and work areas require eye protection, and 
the type of eye and face protection that must be used (such as suitable approved safety 
spectacles, goggles, or shields). Optometry consultation should be requested when the 
need is indicated in conjunction with the task, 

3.10.3.4.3. Safety hats and caps provide workers protection from impact, heat, 
electrical, and fire hazards, and must consist of the shell and the suspension combined 
as a protective system. Hats or caps will meet ANSI standards for the protection 
required, 

3.10.3.4.4. Functional managers, with the assistance of the Base Safety Officer, 
determine what work areas and operations require personnel to wear special foot 
protection. Guidance is provided in AFOSH standards written for specific operations. 

3.10.3.4.5. Belts and lanyard assemblies must he visually inspected for defects prior 
to each use. The assembly must be inspected according to the manufacturer's 
recommendations at least twice annually. The date of each inspection must be recorded 
on an inspection tag that is permanently attached to the belt. 

3,10.4. Identification of control procedures must be provided for hazardous conditions 
resulting from a spill or other mishap. Waste disposal procedures are also specified. 



3.10.4. i. Rags, cotton waste, sawdust, excelsior, or other materials of a large surface 
area that have absorbed hydrazine or ffonomethylhydrazfne (MMH) may eventually cause 
spontaneous ignition. Such materials should not be stored under conditions that prevent 
dissipation of the heat tiiat can accumulate by the gradual process of air oxidation, 

3.10.4.2. Nitrogen tetroxide (^(tyl and mixed oxides of nitrogen are oxidizers, but 

they are not hypergolic with all combustible materials. Such non-hypergolic mixtures 

present an explosion hazard, particularly when Subjected to elevated temperatures, 
pressures, or impact. 

3.10.5. All operations involving the transfer or handling of N2O4 or hydrazines 
must he performed by groups of two or awre persons with a thorough knowledge of the 
nature and properties of the materials. 

3.10.6. Toxic Hazard Corridors (THC) forecasts provided for toxic propellant transfer 
operations are the basis for area access control. Input to the THC forecast by *:r,e user 
must consider the most credible spill quantity and expected wetted area of the incident. 

3.30.7. An adequate water supply must be available for diluting, flushing, decontami- 
nating, and firefighting when handling hazardous materials. 

3.10.8. Suitable body-protective-clothing (acid and fuel-resistant, vinyl coated 
fiberglass protective suit) should be worn {AFH 161-30, Chemical Rocket/Propellant 
Hazards* volume II, appendix C). Polyethylene clothing my also be worn. Fiberglass 
clothing impregnated with acid-resisting plastics such as polytetrafluoroethylene {TFEj 
and polyranochlorotrifluoroethylene, is excellent for handling HgO^ and Eiixed oxides 
of nitrogen. Some types of rubber may burn when they eoiw into contact with ttfy or 
mixed oxides of nitrogen. The clothing must cover all parts of the body that may be 
exposed. It must be adjusted so it prevents leaks or spills from contaminating the body 
or draining into boots or gloves. An approved type of hood must be worn to protect the 



3.11. Propellants and Propulsion System;; 

3.11.1. The design considerations contained in AFSC Design Handbook CH 1-6, TO 
00-25-223, HIL-STD-I522, AFH 161-30; National Fire Prevention Association (UFPA) 70; and 
AFOSH standards are used in designing launch vehicle and spacecraft liquid propellant 
propulsion systems. All agencies using WSKC facilities nmst meet the following 
requirements: 

3.11.1.1. Missile support systems piping and storage at launch pads or missile 
facilities must he identified according to MIL-STD-I247B. 

3.11.1.2. Propellant lines and electrical lines must be located or designed to make 
sure that a single failure, such as leakage or electrical arcing, cannot cause ignition 
of the propellant. 

3.11.1.3, A method must be provided for detanking propellants and decontaminating lines. 

3.11.1.4, Ensure that GSE for loading dual propellant systems can be used independently 
and can be individually leak-checked. 

3.11.2. All tanks, containers, and areas where toxics are handled must 
with due regard for the minimum safe distance established by DOD regulations. 

3.11.3. Storage, transfer, and areas when; toxics are tested must be kept clean, free 
from combustibles, and frequently inspected. 



3.11.4. There should be at least two access roads to transfer and storage sites of 
■hazardous materials. Emergency egress personnel gates shall be installed and located on 
perimeter fencing to permit rapid evacuation of areas wherever toxic propellants are 
handled, transferred, or Stored. 

3.11.5. A written procedure with a checklist defined by the proper authority is 
required for operations involving filling of operational tankage. 

3.11.6. The US Coast Guard is responsible for enforcing regulations concerning shipment 
of explosives and other dangerous materials via water, either all or part of the way. 
The regulations are contained in Coast Guard (USCGl-108, 

3.11.7. Hazardous materials must be marked according to DOT classifications during 
shipment (for example, KKH is required to have a red label with a placard displaying 
"FLAHMABLE"). 

3.11.8. Test requirements are: 

3.11.8.1. New, modified, relocated, or repaired propellent storage or transfer systems 
must be validated by a functional or proof pressure test prior to certification for 
operational use. 

3. 11. 8.2. The user Kust certify in writing in the ARAR that system or subsystems have 
satisfactorily passed the required tests. The test data roust be available for review. 

3.12. Pressurized Systems: 

3.12. 1. Design requirements are: 

3.12.1.1. Pressure system design considerations are contained in KL-STD-1522, TO 
00-25-223, HIL-M5I8* African Standard of Mechanical Engineers (ASK) Codes and AFSC 
DH 1-6. KIL-STD-12478 is used to identify lines on launch pads including GSE and flight 
equipment. MIL-STD-IQIB is used for systems other than missile launch systems, 

3. 12. 1.2. A detailed system functional analysis must be performed to determine the 
operation, interaction, or sequencing of components will not lead to unsafe conditions, 
personnel injury, major damage to the spacecraft or RY, its booster, or associated 
ground support equipment. 

3.12.1.2.1. System analysis data shows that the system provides the capability of 
maintaining all pressure levels in a safe condition in the event of interruption of any 
process, or control sequence, at any time during test or countdown. 

3.12.1.2.2. A complete structural analysis must he accomplished for all presS'ta 
systems. The results of the structural analysis indicates- safe stress levels for 
components and the structures required to support them. 

3.12.1.3. During prelaunch pressurization, pressure monitoring must be provided by 
means of a hardline umbilical cable or telemetry. 

3.12.1.4. Design via fracture mechanics is acceptable in lieu of conventional safety 
factors, but full records and analyses are required for review and approval by WSKC/SE 
on a case by case basis. 

3.12.1.5. Personnel exclusion requirements for fracture mechanics-designed pressure 
systems is based on a "fail safe" basis (ductile vs brittle fracture mode). 
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3.12.2. Proof-pressure testing of modified or newly assembled systems is the same as 
for pressure vessel testing in MIL-STD-1522. 

3.12.3. Ground support pressure vessels are designed according to MIL-STD-1522 or ASKE. 



3.12*4.1. The 2:1 safety factor must not tie violated in the pressure vessel by any 
combination of pressure and dynamically induced strain during on-base transport of 
pressurized AVE. 

3,12.4.2. Unmanned launch vehicle pressure vessels which have a safety factor of less 
than 2:1 must be pressurized remotely. All personnel must be evacuated during 
pressurization and must stay evacuated as long as the vessel is pressurized. The only 
exception to this requirement is if a fracture mechanic's analysis is accomplished and 
the results show the pressurized vessel will leak before bursting- The analysis must be 
approved by HSHC Systems Safety Division (5ES), 

3.12.5. The data specified in KIL-STD-1522 will be supplied as an appendix to the ARAR, 
including complete schematics of the systems depicting pressurization and 
depressurization capabilities. 

3.12.6. Where ft is necessary to provide pneumatic pressure gauges for Visual resd&st 
on pressurization systems, the requirements must be applied for safe design of pressure 
gauges specified in TO 00-25-223. 

3.12.7. Design all pressure systems so that supply and operating pressures can be 
aionitored by gauges or other suitable indicators (that is, remote monitors at control 
station). 

3.13. Ordnance Systems: 

3.13.1. This section establishes the policies and procedures to be raet in design and 
operations such as handling, storing, installing, testing, and connecting ordnance 
during prelaunch operations at «SKC. Ordnance is defined as all electro-explosive 
devices (EED), detonators, squibs, primers, pyrotechnic devices, initiators, ignitors, 
solid propellants, explosives, warheads, ammunition, fuses, and energy transfer systems 
including, but not limited to, primacord, superzip, mild detonating fuse (MDF), and 
confined detonating fuse (CDF). Liquid propellants are also defined as ordnance by DOD 
for siting, storage, and handling purposes. In this document, liquid propellants are 
covered in paragraph 3.11. 

3.13.1.1. Prior to first use of a procedure involving operations with live ordnance or 
pressure systems, practice operations should be conducted at VAFB using inert or dummy 
ordnance or nonpressurized systems. Certification as to the conduct of the dry run will 
be submitted with the ARAR. 

3.13.2. Ordnance items must be assigned the appropriate DOD hazard classification 
according to DODS 5154-4, chapter 4. Items not previously classified must be tested 
according to TO 11A-M7 (NAVORD Inst 8020.3) and classified accordingly. The user is 
responsible for classification tests and for submitting the results to USMC/SE for 
concurrence. Preliminary DOD ordnance hazard classification data must be provided to 
WSMt/SSS prior to arrival of the ordnance on the range. AH ordnance initiating items 
will be classified as a Range category A or B device for both the preinstaliation and 
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postinstallation situations. Category A EEDs are those that, by the expenditure of 
their own energy or because they initiate a chain of events, nay cause injury (or death) 
to people or damage to property. Category B devices are those that will not, in 
themselves (hand-safe) or by initiating a chain of events, cause injury to people or 
damage to property (3.13.4 below for test requirements.) 

3,13.3. Ordnance subsystems and their components will be designed according to 
ML-$TD-1576. Ordnance devices such as solid propellant rocket motors, destruct 
charges, and other ordnance systems will be designed so the sensitive or initiating 
elements can be installed in the system just prior to electrical hookup and as late in 
the countdown as possible or practical. 

3.13.3.1. For fault tolerance general requirements, the design of an electro-explosive 
subsystem performing a safety critical function shall tolerate a minimum number of 
credible failures or operator errors according to the following criteria according to 
Mtl-STD-1576. 

3.13.3.1.1. If loss of ordnance function is safety critical, the design of the 
electro-explosive subsystem shall preclude single point failures and shall include at 
least two EEDs. 

3.13.3.1.2. If inadvertent firing is safety critical, the design of the electro- 
explosive subsystem shall provide a condition such that no single failure or operator 
error can cause a critical hazard and no ceEbinaticn of two failures or operator errors 
can cause a catastrophic hazard. 

3.13.3.2. Category A EEDs oust meet the requirements of this paragraph to minimize the 
hazards of electromagnetic radiation to EEDs. Special considerations are given by 
WSKC/SE to any new EED concept or design that demonstrates adequate selectivity in 
response between direct current and radio frequency energy while maintaining reliability. 

3.13.3.2.1, Category A ordnance circuits must he interruptible as close to the ordnance 
item as possible. 

3.13.3.2.2, Category A ordnance devices must have one-amp and one-watt no-fire 
survivability. 

3.13.3.2.2.1, The no-fire current must not be less than one ampere as the result of the 
application of a direct current (DC) voltage for five minutes, without the use of 
external shunts. 

3.13.3.2.2.2, The no-fire power must not be less than one watt as the result of the 
application of a DC voltage for five minutes, without the use of external shunts, 

3.13.3.2.3, The survivability levels of each EED, in its most sensitive mode, nust be 
determined in terms of the RF power density that could produce the maximum-no-fire power 
in its bridgewire. In lieu of the one amp, one watt requirement, the WSMC user may 
validate the survivability of each electro-explosive device before, during, and after 
installation according to test method 4303 of HIL-STD-1576. 

3.13.3.2.3.1. An EED firing circuit must not operate unintentionally when subjected to 
the RF radiation levels present at applicable W$(C locations. USE/SE can provide 
descriptions of the KF environment upon request. 

3.13.3.2.3.2. In addition to validation of system survival, HSKC users must comply with 
requirements of 3.13.3.2.4 below, for firing circuits. 



WSHCR 127-1 15 May 1985 3-17 

3.13,3,2.1 All category A firing circuits must be interrupted between the ordnance 
item and the power source by using an SfiA device, arm/disarm device, barometric switch, 
arm or safe plug, or equivalent device that provides positive interruption of the 
circuit. These devices should be as close to the ordnance end of the circuit as 
possible. The dev.ces must be capable of performing the inhibiting function when power 
is applied to the firing circuit. There is no mandatory range requirement for an 
ordnance system to contain a specific type of ordnance safing device in the ordnance 
circuit. The range requirement is for the following inhibit criteria to be iiet under 
all conditions. Three independent circuit inhibits are required for unlimited exposure 
of personnel during test. Two independent circuit inhibits will reduce exposure to 
essential personnel only and no exposure of personnel will be permitted if a circuit has 
only one inhibit, A range approved ordnance safing device that is manually pinned and 
safed can be counted as two (2) inhibits with pin in place- 

3.13.3.2.4.1. Firing circuit leads and junctions must be shielded without electrical 
discontinuities or gaps to provide a minimum of 20 dB attenuation at all frequencies of 
the expected electromagnetic environment, 

3.13.3.2.4.2. EED firing circuits, including EED leads, must be isolated fron other 
electrical circuits and each other by means of individual shields at all times. 
Insulation resistance between all insulated parts, at a potential of 500 VDC minium, 
must be greater than 2 megohms. Electromagnetic Interference (EM) shielding between 
conductors must be 20 dB oinimun. Shielded EEO circuits may be routed together in a 
common secondary shield. 

3.13.3.2.4.3. Firing circuit shields must be continuous from the power source to the 
EED cases. Splicing is prohibited. If the EED is enclosed in a metal container 
providing attenuation at least equal to that of the shield, the shield nay be terminated 
at the container. Shields need not be carried through a connector if the connector can 
provide 8F attenuation and electrical conductivity at least equal to that of the 
shield. Shields terminated at a connector must be electrically joined with no gaps 
around the full 360 degree circumference of the shield. 

3.13.3.2.4.4. Firing circuit conductors, including EEO leads, must be twisted and 
shielded to reduce induction from external alternating current (AC) and RF sources and 
maintain electrical balance in AC circuits. 

3.13.3.2.4.5. If the power source is electrically isolated until after liftoff, shield- 
ing to the positive interruption rather than to the power source Hay be acceptable- 
Approval is dependent upon the RF characteristics of the positive interruption. 

3.13.3.2.4.6. Demonstration of survival in the HSMC ground and aerospace vehicle 
environment must show that the EED cannot receive more than 20 dB below its maximum 
no-fire power in all modes of use and exposure. Computed RF power density levels for 
WSHC facilities are available from KSHC/SE. 

3.13.3.3. A S5A device is a range approved, highly desirable, inhibit for category A 
firing circuits. SM devices must satisfy the following requirements (exceptions for 
Exploding Bridgewire (EBW) systems are stated in 3.13.3.6 below). 

3.13.3.3.1. when an SM device is in the safe position, electrical shorts internal to 
the device must be maintained on the initiators and the explosive train will be 
interrupted by a mechanical barrier capable of containing the initiator's output energy. 

3.13.3.3.2. When an SSA device is in the armed position, there is mechanical alignment 
of the explosive train and electrical continuity from the firing circuit connector to 
the initiator within the device. 
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3.13.3.3.3. SSA devices indicate armed or safe condition status by simple visual 
inspection. 

3.13.3.3.4. For rotating devices, transitions from the safe to the armed position 
should require 90 degrees of rotation of the mechanical barrier. The device must not be 
capable of propagating an ordnance initiation with the barrier rotated less than 50 
degrees, or movement of less than 50 percent for sliding barriers with the barrier in 
place, 

3.13.3.3.5. The remote safe indication should not appear unless the device is within 10 
degrees of the normal safe position for rotating systems or 10 percent of the total for 
sliding barriers. The remote anted indication $asuld not appear unless the device is in 
a position that initiates the explosive train rfith *he required reliability and 

: level. 



3.13.3.3.6. The visual safe indicator should not be visible unless the device is within 
10 degrees of the normal safe position. 

3.13.3.3.7. A positive mechanical lock (safety pin} must be used in the device to 
prevent movement from the safe to the armed position. Rotation of more than 10 degrees 
(Sust not be possible with the safety pin installed. Removal of the safety pin must not 
be possible if the arming circuit is energized. Removal of the safety pin will not 
cause the device to arm. 

3.13.3.3.8. The control and monitor circuits must be completely independent of the 
firing circuits and use a separate and noninterchangeable electrical connector. 

3.13.3.3.9. The device oust provide a means of mechanical safing in the event of a 
malfunction or abort. During' mechanical safing, the S&A must not cycle through the 
armed position. 

3.13.3.4. Shielding caps must be provided and placed on the EED during shipment, 
storage, handling, and installation up to the point of electrical connection in the 
missile. The shielding cap will have an outer shell made of conductive material that 
provides an RF shield and makes electrical contact with the EED case. There will not be 
RF gaps around the full 360 degree mating surface between the shielding cap and the EED 



3.13.3.4.1. The shielding cap must be designed to accomodate the torquing tool during 
installation or the torquiny tool is designed to fit over the shielding cap. 

3,13.3.5. Normally, percussion activated devices are initiated by the impact energy of 
a firing pin. This can be accomplished by "stab initiation," where the firing pin 
pierces the primer, or by percussion, where the firing pin does not puncture the case. 

3.13.3.5.1. Only percussion initiators will be used and will meet the requirements of 
3.13.3.2.4 above for category A ordnance circuits. 

3.13.3.5.2. Each initiator must have a positive safety- interrupter feature that can be 
mechanically locked in place. 

3.13.3.5.3. The initiator, and its interrupter, will be designed to withstand all 
transportation, handling, and installation environments. 
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3.13.3.5.5. Tlie interrupter safety lock will be designed to he removed after installa- 
tion, 

d to automatically disengage after launch es 



3.13.3.5.7. The design must make sure the device cannot be assembled without the 
interrupter, 

3.13.3.5.8. Inadvertent firing pin activation requires at least two independent faults 
in addition to the mechanical safety lock. 

3,13,3,6. EBW system initiators, by their nature, require high current for firing and 
are considered to meet the requirements of 3,13,3.2.2 above. However, EBW systems must: 

3.13.3.6.1, Include a dual bleed system with either system capable of bleeding the 
capacitor charge. 

3.13.3.6.2, Have remote monitoring of the capacitor charge status, 

3.13.3.6.3, Include a voltage blocking gap that breaks down at voltages consistent with 
reliable initiation. The voltage blocking gap should break down within 1045 milli- 
seconds at approximately 1800 + 300 volts when subjected to a peak voltage of not less 
than 2200 volts across a load of not less than 90 megohms. 

3,13.3,6-4, Have a gap that breaks down when subjected to a high voltage pulse of short 
enough duration to provide apiple amperage into the bridgewire to cause the EBW to 
explode with sufficient energy to reliably transmit the reaction to the prime charge. 

3.13.3.6.5. Contain explosive materials of an insensitive mixture such as 
pentaerythritol tetranitrate (PETN} and research department explosive (RDX). 

3.13.3.6.6. Have insulation resistance between the tenninal(s} and any device and must 
not be less than I megohms at 500 volts DC. 

3.13.3.6.7. Have a device that does not fire or degrade when subjected to 25,000 volts 
from a 500 pfd capacitor. 

3.13.3.6.8. Have a device that does not fire or degrade when subjected to a voltage of 
125 to 130 volts roots mean square (Vras) at 60 Hertz (Hz) applied between the terminals 
or the terminals and the device body for 5 minutes + 10 seconds. 

3.13.3.6.9. Have a device that does not fire or degrade when subjected to a source of 
500-520 volts having an output capacitance of 1.0 + .10 microfarads applied across the 
terminals or the terminals and device body for l.tTto 1.5 minutes. 

3.13.3.6.10. Have a device that does not fire or degrade so it is unsafe to handle when 
230 + 10 volts Vrms at 60 \a are applied between the terminals and the terminal and 
device body for 5 minutes + 10 seconds. 

3.13.3.6.11. Have a unit that does not fire or degrade after exposure to that level of 
power equivalent to absorption by the test item of 1.0 watt average power at any 
frequency within each range of RF energy, as specified in table 3-1. The power is 
applied across the input terminals of the EBW detonator for 5,0 to 6,0 seconds. 
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Frequency in Megahertz 
1.5 


Modulation* 
Continuous Wave 




27,0 


Continuous Wave 




154,0 


Continuous Wave 




250,0 


Continuous Wave 




900.0 


Continuous Wave 




2700.0 


Pulsed Wave 




5400,0 


Pulsed Wave 




8900.0 


Pulsed Wave 




15O00.O 


Continuous Wave 




32000,0 


Pulsed wave 





*Pulsed wave has a modulation with pulse width of 1 microsecond and puis* 
repetition rate of 1 KHz. 

Table 3-1. RF Sensitivity. 



3.13,3.6.12. Maintain auto-ignition temperature of the device above 300F. 

3.13.3.7. Category B EEDs are not required to comply with the RF and stray voltage or 
no voltage requirements of this chapter. RF protection for category B EEDs is the sole 
responsibility of the HSMC user. RF silence is not scheduled to protect category B EEDs. 

3.13.3.8. Ordnance circuits shall be capable of being manually safed during any phase 



3.13.3,9. This paragraph establishes the policies for the user to accomplish the 
selection, and identify the usage, of plastic filia materials in conjunction with 
payloads and missile systems at VAFB. 

3.13.3.9.1, A written safety analysis shall be prepared by the user and submitted to 
WSHC/SE for approval and shall include, but not be limited to: 

3,13.3.9.1.1. Identification and characteristics of the plastic flla to be utilized. 

3. 13.3.9. I.E. The method or conditions under which the materials are to be utilized . 



3.13.3.9,2. Hazard control measures will include; 

3.13.3.9.2.1. Identification of the bleed-off capability of the "as-used" configuratioi 

3.13.3.9.2.2. Identification of the method to be utilized to assure continuing anti- 
static properties of the selected material or method. 



3.13.3.9,2.5. Establishment of a method for assuring continuity between adjoining 
pieces of the plastic film materials. 



3.13.3.9.2.6. Identification of flammable or explosive materials and methods for 
monitoring for the presence or status of these materials. 

3.13.3.9.2.7. Identification of the energy source required to cause ignition of 
flammable or explosive mixtures and the methods to preclude this ignition. 

3.13.3.9.2.8. Identification of clothing and equipment restrictions for personnel 
performing the identified operations. 

3.13.3.9.2.9. Assessment of the environmental effects on the selected material; such 
as humidity, ultra-violet light, temperature. 

3.13.3.9.3. The user shall provide the above information to USHC/SE for review and 
approval at least 120 days prior to the first planned use of the selected materials or 
operations at VAF8. 

3.13.3.9.4. The user shall notify WSHC/SE of all proposed changes to the above 
information prior to performing operations utilizing those changes, 

rith usage of the materials at VAFB, approval must be 



3.13.3.9.6. Spacecraft and launch operations at VAFB will not be conducted in relative 
humidities below 4SJ without specific approval from WSNC/SE. 

3.13.3.9.7. Additional information concerning guidance for selection of plastic film at 
VAFB may be obtained by contacting WSHC/SES. 

3.13.4. Test requirements are: 

3.13.4.1, Operations having an electrical potential applied to an ordnance item will be 
considered as electrical testing of ordnance. All electrical testing of category A 
ordnance will be considered as hazardous until the range user submits an analysis to 
HSHC/SES which proves otherwise. Electrical testing of any ordnance item that could 
result in injury or death to personnel (if the item should fire) must be conducted 
remotely (for example, in a test cell or behind a barricade or shield). All test 
equipment used to check out ordnance and ordnance circuits must be approved by WSMC/SKS 
prior to use on the range. 

3.13.4.2. For special ordnance tests, such as in nonapproved test locations or test 
cells, a justification of why the test has to be performed in location described and 
time sequence must be provided. It must include the data below, plus a description of 
what alternatives were considered and rationale for the decision; 

3.13.4.2.1. All procedures and ordnance circuit schematics relating to electrical 
testing of ordnance. 

3.13.4.2.2. Precautions to prevent injury to personnel or damage to equipment. 

3.13.4.2.3. A description of the location and configuration of the test. 

3.13.4.2.4. A description of worst case event as a result of initiation of each device 
being tested. 

3.13.5, The user submits copies of the information in the format shown on KSK Fori 87, 
Validation of Compliance, and WSHC form 96, Ordnance Technical Data, as an appendix to 
the ARAR. Where identical ordnance items or SSA devices have been approved and utilized 
on other programs at HSHC, the user need only reference the ordnance item or SSA devices 
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and the approval date and authority in lieu of submitting WSHC Forms 87 and 96. 

3.13.6. EMI testing will not be conducted with category A EEDS installed on the vehicle 
or payload without written approval by USMC/SE, 

3.13.7. The HSMC user is responsible for making no voltage or stray voltage checks on 
circuitry connecting to category A ordnance prior to the connection or prior to test 
equipment and support equipment connections to such circuits. A no voltage check» for 
example, would be made when mating two missile stages and one of the stages contains an 
AVE battery or other voltage source. The test would be made looking for no voltage 
toward the voltage source prior to making the final connection. A stray voltage check, 
for example, would be made prior to connecting ground test equipment to a single stage 
for electrical testing. Stray voltage tests should be made with equipment in a POWER ON 
condition and then in a POWER OFF condition. This sequence is to assure there are no 
sneak circuits in the cable or equipment which may allow voltage to exist on the 
ordnance circuits. In instances where some voltage is permitted, it must be specified 
in the test procedure and approved by WSMC/SE. These tests are not necessary in 
category ordnance circuits and may not be required on Category A circuits depending 
upon the number of inhibits in place at the tiiae of final cable connection. It is the 
responsibility of the HSMC user to obtain a deviation from HSHC/SE when such tests are 
not accomplished on category A circuits. 

3.13.8. The range user is responsible for ensuring that render safe procedures and 
normal safing procedures are available for their systems. 

3.13.8.1. Render safe procedures must be available prior to arrival of the range users' 
first live ordnance at Vandenberg, Normal safing procedures must be available to 
support launch countdown operations (i.e. hangfire, misfire, no fire). 

3.13.8.2. (formal safing, as used in this regulation, applies to the act of returning 
ordnance systems to a safe configuration. It differs from render safe functions in that 
ordnance system status Or control is not lost. For example; A missile hangfire, 
misfire, or no fire where ordnance systems can be remotely returned to a safe condition 
and system status is not lost, will be accomplished with a normal safing procedure. A 
hangfire, misfire, or no fire with loss of ordnance status or loss of ordnance system 
control where safety of the safing crew cannot be guaranteed, will normally be 
considered a render safe function for returning the system to a safe condition. Render 
safe procedures performed by EOD and/or contractor support personnel would be used for 
that situation. The range user mst clearly identify in the MSGSA submittal, specific 
tasks his support contractors will or will not perform during render safe operations. 
WSMC/SE recognizes that written procedures cannot be prepared in advance to address all 
possible variations of render safe tasks. However, the range user must consider as many 
different render safing tasks as feasible and must have a normal safing procedure to 
recover from a missile hangfire, misfire, or no fire situation. 

3.13.8.3. All render safe and normal safing tasks will be considered hazardous until 
ordnance systems are returned to a known safe condition. HSMC/SES will approve them 
prior to use. 

3.13.8.4. Render safe procedures and adequate EOD or contractor support personnel 
training with those procedures are mandatory prior to issuing HSGSA by WSMC/SES . The 
range user must plan, program, and fund for render safe procedure preparation as well as 
EOD or contractor support personnel training for render safe operations as required. 

3.14. Electrical and Electronic Systems: 
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3.14.1.1. Elements of safety-critical redundant systems may not pass through the same 
connector used by elements of the primary system. 

3.14.1.2, System design limits the use of connectors to applications that require 
frequent disconnection, such as for rapid component replacement. Hardline wiring is the 
preferred means of connection. 

3.14.2. Hazardous atmosphere areas are those locations where possible explosive 
concentrations [dust, vapor, or gas) stay exist and, therefore, require explosion-proof 
or hazard-proof equipment. Hazardous areas are defined in the National Fire Protection 
Association (NFPA) codes and standards. 

3.14.2.1. Electrical and electronic systems located in hazardous atmosphere areas must 
be certified to WSKC/SE showing compliance with the requirements of the SEC, NFPA 70. 

3.14.2.2. Electrical and electronic equipment must be "explosion-proof per article 
500, NEC, or hazard proofed (by potting, hermetically sealing, or by positive pressuri- 
zation with an inert gas}. Where large enclosed rooms of equipment are located in the 
hazardous atmosphere area, it is acceptable to pressurize these rooms to at least 1/10 
inch of water with clean air or inert gas taken from outside the area, preferably from 
two remote sources. No propellants will be kept in these rooms. An alternate accept- 
able method is to install leak detectors in the hazardous atmosphere area with a single 
monitoring station. A wster switch at the monitoring station must be capable of 
deactivating all nonexp los ion-proof or nonhazard-proof equipment in the area; this 
station must be manned at all times when a hazardous atmosphere may exist, or 
automatically deactivate the nonexplosion-proof equipment when 25 percent of the lower 
explosive limit of hazardous atmosphere is reached. Before "hot work" is performed, it 
must be verified that hazardous atmosphere concentrations are less than four percent of 
the lower explosive limit. 

3.14.2.3. Electrical and electronic equipment within 100 feet of a missile must meet 
the hazardous atmosphere requirements of the NEC, article 500. 



3.14.3.1. Connectors must be keyed, sized, or configured so it is physically impossible 
to interconnect incompatible systems. Where cross-connection has no impact on system 
operation or performance, connectors may be identical. However, a statement to this 
effect is required as part of the data submittal, 

3.14.3.2. Airborne batteries will be provided with current limiting devices or equiva- 
lent protection on their output and input lines. Temperature sensitive devices monitor 
battery temperature and disconnect the battery in the event of overheating. 

3.14.4. Electronic design of all GSE will incorporate a main power switch located on 
the equipment. If fault isolation switches are incorporated in the design, they may not 
apply power independently of the main power switch. 

3.14.4.1. The equipment must be constructed and designed so external parts, surfaces, 
and shield are at GSE ground potential at all times. 

3.14.4.2. Power switches must be located and guarded so accidental contact by personnel 
does not place equipment fa operation. Critical switches that can produce or induce 
hazardous conditions if inadvertently activated must have a protective cover over them. 



3,14.4.4. Electrical fuse and switch boxes must be stenciled on the outside to show the 
voltage present and the functions controlled by the circuits. 

3.14.5, Batteries must be capable of easy disconnection and removal. 

3.14.5.1. Polarity of terminals must be marked. 

3.14.5.2. Connections must be designed to prevent reverse polarity. 

3.14.5.3. Sufficient ventilation must be provided. 

3.14.5.4. Battery charging current must be limited by design. It must be impossible to 
initiate or sustain a runaway failure of a battery because of the charging current. 

3.14.5.5. Batteries will be sealed and must have pressure relief valves or blowout 
plugs. Vented batteries must vent gases to an area where ignition of gas is impos- 
sible. Recombination cells must be used whenever possible, 

3.14.5.6. Cell and case retention must be provided to the maximum extent possible to 
minimise the hazard of battery rupture. Proper ventilation as described in 3.14.5.5 
above must still be maintained. 

i cool, well-vented area remote from 



3.14.5.8. Lithium batteries require hazardous procedures for all operations to include 
storage and disposal. 

3.14.6. Mechanical or electro-mechanical devices used for structure deployment or 
actuating release mechanisms are evaluated to establish if damage to equipment or injury 
to personnel could occur in the event of inadvertent initiation. If it is determined 
that damage to equipment or personnel injury could result, the device, or devices, must 
be controlled in a manner similar to category A ordnance devices. At least two 
independent actions must be taken in a serial sequence prior to activation of the device, 

3.14.7. Grounding, bonding, and shielding requirements are; 

3. 14. 7.1. Missile ordnance items and related handling equipment must remain grounded 
during receipt to launch processing tasks. This is particularly true of missile stages 
with EEDs installed and especially true during stage lifting operations with cranes. 
Many different methods of grounding exist and the particular method chosen is left to 
the discretion of the range user. The main guideline to be followed is that the 
ordnance item and anything conductive which interfaces with it must be kept at the same 
voltage potential. The range recognizes that ordnance cannot be kept grounded at all 
times, for example, transportation, but the range user must describe his grounding 
methods and exceptions, with analysis, in the ordnance section of the ARAR. 

3.14.7.2. Solder connections must not be used on ground circuit connections, 

3.14.8. Users are responsible for verifying that requirements of this section have been 
met. The adequacy of grounding and interlock mechanisms are of particular concern. 
These items must be reverified before operations at WSHC, 



3.14.8.1. The discharge (to 30 volts or less) time is required for all capacitors that 
are charged to 30 volts or more, 

3.14.8.2. Users who design, build, or modify intrinsically safe apparatus for use in 
class I, II and III, division 1 hazardous locations must submit all test results 
required by IIFPA 493 to WSMC/SES, 

3.14.9. The user submits copies of the information in paragraph 3,14,0 above for all 
electrical and electronic systems as an appendix to the AMR. 

3.15, Software and User-System Interface (USD: 

3.15.1. Software requirements shall be addressed during the earliest stages of system 
development and shall be worked in parallel and concurrently with hardware requirements, 

3.15.2. All computer software (including that associated with embedded computers and 
computer systems or associated with automated test equipment) used to control or monitor 
safety critical ground or flight sequences, functions or processes shall be designed 
according to attachment 3, as tailored by WSHC/SE in conjunction with the procuring 
agency. In addition, Weapon System software development shall be accomplished according 
to HiL-STD-1679 and trainer system software shall be accomplished according to 
HIUSTO-1644. 

3.15.3. The software system shall met the requirements of HIL-STD-1574. 

3.15.4. The system software shall possess the following general properties charac- 
teristic of high quality software: correctness, reliability, va 7 idity, resilience, 
useability, clarity, maintainability, ciodifiability, generality, testability, efficiency 
and economy. 

3.15.5. Procedures, rules, and constraints shall be used for program design, program 
structure and data structure which enhance the readability, controlability, testability, 
extendability, reliability and maintainability of programs and which minimize rework 
during the programing process. 

3.15.6. The software structure shall be standard and allow for additions, deletions, 
and modifications of software modules to accommodate requirement changes with minimal 
impact to the software. 

3.15.7. The software system design shall be compatible with the hardware system design. 

3.15.8. The software system shall be capable of fully utilizing the hardware system 
capability. 

3.15.9. The software system shall be designed to not overstress the hardware system. 



3.15.11. The software system shall have the capability to detect and isolate computer 
system failures and provide standby or alternate paths to permit safing of critical 
functions. 

3.15.12. The software system shall have the capability to detect safety critical 
malfunctions. It is desirable for software to determine the source and effect of such 
malfunctions, evaluate the effect on the system and any consequent effect on the 
mission, determine the corrective action to be taken, implement said corrective action 
when and where appropriate, and retest the system after corrective action has been 
completed. 
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3.15.13, Computer program and equipment interfaces shall provide a functional inter- 
face between the elements of the systeis, including the system operators, maintained and 
the computers (see HJL-STD-T472C, para. 5.15, Personnel-Computer Interface). This 
interface shall optimize compatibility with personnel and minimize any other factors 
which degrade human performance or contribute to human errors. 

3.15.14, Software products shall be fully documented and a configuration manageoent and 
control program shall be implemented to insure integrity and accountability of all 
operational software products [HIL-STD-480, -483, and -490)* 

3.15.15, All operator initiated commands which perform safety critical sequences cr 
functions (such as propellant flow and launch initiation) shall, as a minimum, be 
written as two step 'ARM' and 'EXECUTE' commands. 

3.15.16, The user shall provide the following information to WSHC/SE: 

3.15.16.1. Hardware description including layout of operator consoles and displays. 

3.15.16.2. Flow charts or diagrams showing hardware, data busses, hardware or software 
interfaces, data flow, and power systems. Show redundant systems. 

3.15.16.3. Logic flow chart. 

3.15.16.4. Operator user manuals and documentation. 

3.15.16.5. List with description of all critical software nodules including interfaces. 

3.15.16.6. Software hazard analysis (SUA). 

3.15.16.7. Configuration management plan and procedures. 

3,35,16.0, Software test plan, test procedures and test results. 

3,15.16.9. Copies of any Soft Tree, Sneak Circuit, Petri llet, IISCCA or other hazard 
analyses accomplished on the hardware or software. Such analyses should address the 
hardware and software interfaces. 
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Chapter 4 

FLIGHT TERMINATION AND TRACKING TRANSPOSES SYSTEMS 

4.1. Flight Termination and Tracking Transponder Systems Introduction. Paragraphs 1.8 
and 1.9.1 require that all missiles and space vehicles flown from the WTR be equipped 
with a flight termination system and a tracking transponder system. This chapter sets 
forth the design, operation, testing, and data requirements, and prescribes the 
procedures for approval and use of those systems at WSHC. 

4.2. Approval Requirements: 

4.2.1. USMC Flight Termination Division (SEO) participation during the flight 
termination system development phase reduces costly engineering changes at a later date 
and facilitates timely system approval; therefore, contact should be established with 
HSHC/SEO as early in the development phase as possible. HSHC/SEO shall be notified of, 
and represented at, TI, SDR, POR, and COR meetings. Inforaation, including meeting 
purpose(s) and agenda items, with as many amplifying details as possible, shall be 
provided to HSHC/SEO as early as possible but in no case less than 10 days prior to the 
meeting. This provides time for preliminary evaluation of the agenda items and enables 
the HSHC/SEO Range Missile Control Representative (RHCR) to identify problem areas, 
negotiate acceptable changes, and provide interim approvaHs) at the meeting. Further, 
if adequate information is provided prior to the meeting, the RHCR may reccaend waiver 
of specific requirements of this chapter. Each recommended waiver must be fully 
documented in the meeting minutes and the minutes uust b<s signed by the RMCR. However^ 
prior to formal acceptance of the system, a formal waiver action (paragraph 1.7} must be 
accomplished- Foraal acceptance of the system for use at HSHC is granted by HSHC/SEO 
approval of the flight termination report (paragraph 4.7.1,6). Two copies of the report 
mist be submitted to WSE/SEO at least four months prior to the first scheduled launch, 
ideally, an acceptable system and component design have been achieved, qualification 
tests sucessfully completed, and receipt through launch procedures agreed on prior to 
submission of the flight termination system report. Howeyer, if unacceptable conditions 
or open items still exist, they must be foraally resolved so approval can be granted at 
least 30 days prior to the first scheduled launch, 

4.2.2. The detailed test plan(s) and procedure(s) for accepting and qualifying the 
flight termination system must be approved by HSHC/SEO prior to testing. This should be 
accomplished during the applicable technical interchange or design review. Also, at this 
time, the HSHC/SEO representative will identify the individual qualification and 
acceptance test plan(s) and procedure(s) required to be submitted to HSMC/SEO for 
approval . 

NOTE: The terms Acceptance Test and qualification Test are defined in MIL-STD 1540A. 

4.2.3. Detailed procedures for test, calibration, and installation of all components of 
the flight termination system and associated ground checkout equipment, including the 
launch day countdown procedures, must be submitted to HSHC/SEO and approved before 
launch approval is granted. Once these procedures are approved by HSHC/SEO, they cannot 
be changed without prior approval. 

4.2.4. Flight termination systems or components that fail due to damage, unreliability, 
failure to meet manufacturer and model specifications, or limits of this regulation, 
cannot be approved for flight until corrective action, acceptable to WSHC/SEO, has been 
made to all components or systems subject to such failure modes. 

4.2:5. Modification or change to an approved airborne flight termination system, 
associated equipment, components, component identification, test procedures, performance 
test limits, basic characteristics, ratings, or any changes affecting the integrity of 
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the flight termination system, cannot be made without prior WSMC/SEO approval. 
Modification proposals must be submitted 'with sufficient lead time (at least 60 days) 
for evaluation to avoid delay of launch schedule. The proposal must include all data 
information applicable to the modification that is required in the approval of a new 
system. It is conceivable that unique situations will arise requiring expedient minor 
changes to the flight termination system, its associated ground support equipment, or to 
the system testing procedure to permit timely accomplishment of a particular launch 
operation. In this instance, WSfiC/SEO should be notified immediately and maximum effort 
will be expended to conduct a rapid evaluation of the proposed changes. Assistance will 
be provided to achieve a change that resolves problem areas and will be acceptable to 
WSMC. If any modification to an approved system has been made without prior approval of 
HSMC/SEO, the approval of the entire system and the approval to launch is automatically 
revoked until the change is approved. 

4.2.6, Final acceptance of the flight termination system for each launch depends on the 
satisfactory completion of all required prelaunch tests and system installation 
functions. 

4.2.7. HSHC/SEO approves all flight termination component and system qualification, 
acceptance, flight readiness, and operational testing. Certification includes review 
and approval of test procedures and systen test setups, and witnessing of testing at 
each vendor, associate contractor, and prise contractor facility. The Range user 
notifies HSHC/SEO of the date, tide, location, and point of contact for all flight 
termination testing at least ten days prior to the test. MStiC/SEO will then provide 
notification of whether the test will, or will not, be witnessed. 

4.3. Design Requirements: 

4.3.1. The flight termination system must be designed to receive frequency modulated 
radio messages and resultantly terminate flight of the missile or sp?ce vehicle. For 
this purpose, the interdepartment Radio Advisory Committee (IRAC) has authorized a tfSHC 
frequency assignment of 406.5 KHz end 41G.S MHz, 360 KHz bandwidth, F9 emission at 10 KW 
power. Frequency protection is provided by IRAC so no frequency assignment in the 360 
KHz bandwidth will be made to any other agency within 50 miles of the VAFB missile 
launch sites, Therefore, Range user transmitters at test stations are not allowed to 
radiate on the KSMC frequency assignment. Closed loop transmission by Range user 
transmitters, or test stations for flight termination system testing, is permissible 
according to HSNQt 100-1, Radio Frequency Management. A typical flight termination 
system consists of an antenna systen, receiver and decoders, electrical power sources, 
controls, relays, non-destructive flight terminating devices, S£A devices, destructive 
ordnance systems, and interconnecting circuitry. While system design simplicity and 
minimum component usage is a desired goal, the system oust contdn the redundancy 
necessary to meet the requirements of 4.3,1,10,1 below. The required receiver and 
decoder message outputs are specifed in 4.3.3.3.12 below, and tne resultant flight 
termination actions correlated to the vehicle propellant compositions are specified in 
4.3.1.3.1 through 4.3,1,3,6 below. Ideally, each powered stage of the vehicle should 
contain an internally installed radio command link consisting of the antenna systems, 
receivers, decoders, and electrical power sources. However, considerations such as the 
added weight, cost, launch vehicle design, and mission objectives normally preclude that 
configuration concept. As an alternative, a radio cowand link, protected by an 
automatic flight termination activating systen specified in 4.3.1.2,5, 4,3,1,2,8, and 
4.3.1.4 below, is acceptable. 

4,3.1.3, All components of the flight termination system and methods of attaching or 
installing the system must be designed and qualified to make sure the system has the 
ability to function reliably under environmental forces greater than those that would 
result in breakup of the missile while it is within the limits of KSKC safety 
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responsibility. All components of the system must also be designed to withstand, 
without degradation in performance, the environment it is subjected to during storage, 
prelaunch processing, checkout, and launch, Ample consideration must also be given to 
the corrosive environment caused by launch vehicle propellents, humidity, dust, and salt 
atmosphere at WSMC. If the system is subjected to the shock and heat of an igniting 
engine or staging events, it nust also be designed to survive that environment. 
Particular emphasis must be placed on the ability of an automatic system to withstand 
forces greater than these that would lead to destruction of the missile stage joint that 
it is protecting. 

4,3.1.2. Radio cccnand link location requirements are; 

4.3.1.2.1. When the radio command link is installed above the last powered stage, an 
automatic activating system must be provided immediately to activate the flight 
terminating devices on each powered stage if the radio command link container should 
break away or should inadvertently separate from the vehicle. 

4.3.1.2.2. For single stage powered vehicles, the command system must be installed in 
the stage with flight termination control system actuating devices capable of 
accomplishing the action required by 4.3.1.3 below when actuated by the command system. 

4.3.1.2.3. For multi-stage powered vehicles not scheduled for orbital insertion, a 
radio command link must be installed in or above the last (uppermost) powered stage of 
the vehicle. All powered stages must contain flight termination devices capable of 
accomplishing the action required by 4.3.1.3 below- 

4.3.1.2.4. For multi-stage powered vehicles scheduled for orbital insertion, the 
orbital stage(s) will be injected into orbit prior to its [their! ignition, a command 
system is not required on this (these) orbital stage(s). A command system must be 
installed on the powered stage that actually injects the vehicle into initial orbit. 

All stages, including injected powered stages, oust contain flight termination actuating 
devices capable of accomplishing action required by 4,3.1.3 below when actuated by the 
command system. 

4.3.1.2.5. For all multi-stage powered vehicles, an automatic flight termination system 
that meets the requirements of 4.3.1.4 below must be installed on each powered stage, 

iiwliiHifln nrhital cfacf* Tint rnntaininn a cmnand svstea. 



including orbital stages not containing a command sys 



4.3.1.2.6. Cruise or glide vehicles shall contain either a command system according to 
4.3.1 above, or a combination of a command system and a "fail safe" system that is 
activated upon loss of the radio command carrier. If the command system is dependent 
upon a single power supply, a low voltage "fail safe" capability must also be provided 
to actuate flight termination action if the command system primary voltage supply drops 
below the minimum voltage required for operation of the command system. 

4.3.1.2.7. Vehicles that are a combination of ballistic and cruise or glide vehicles 
are treated as a ballistic vehicle during the boost phase, and a cruise or glide vehicle 
thereafter. 

4.3.1.2.8. Propulsion systems or other hazardous systems that are not considered a 
stage of the vehicle may require flight termination control systems capable of 
accomplishing the action required by 4.3,1.3 below when actuated by an automatic or 
command system. This capability is required for all solid motor thrust augmenting 
rockets. In the case of propulsion systems, such as ullage rockets, retro and escape 
rockets, this capability is required only if they present radiological, lexicological, 
explosive, or other significant hazards. In both instances where command capability is 
required, an automatic system that meets the requirements of 4.3.1,4 below will also be 
required if the propulsion system(s) has the capability of reaching the impact limit 
lines in the event of premature separation. 
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4,3.1,2,9. Flight termination systems on manned vehicles must wet the following 
requirements: 

4.3.1.2.9.1. Manned vehicle flight, termination control systems must comply with all 
requirements of this regulation, with the exception that the manned portion of the 
vehicle may not require destruct capability on manned flights. If manned vehicles are 
flown unmanned, all requirements of this regulation must be met. 

4.3.1.2.9.2. Time delays between ARM (engine shutdown) and destruct action, required 
for crew escape, are provided by WSfiC in the ground equipment. The extent of these 
delays is determined by vehicle parameters, the type of escape system, and the degree of 
hazard presented- 

4,3.1,3. Flight termination action requirements are: 

4-3.1,3.1. For vehicles consisting of all liquid propellant stages, both ASM and 
destruct capability are required for each stage of the vehicle [except as noted in 
4.3.1.3*4 below). The transmitted "Arm" coranand must be utilized as a predestmct logic 
function within the command system receiver and decoder. It oust cause nondestruct 
engine shutdown of the thrusting stage(s) and inhibit ignition of all other stages. The 
subsequent transmitted "destruct" command, or activation of the automatic flight 
termination system, must cause the following: 

4.3.1.3.1.1, For liquid propellent stages using toxic propellents, the destruct charges 
must cause penetration of the propellant tanks and initiate rapid burning of the 
propellants so that as much propellant as possible is consumed or dispersed. For toxic 
itypergolic propellants, the requirement for initiation of burning is deleted since the 
propellents burn on contact. The intent of this requirement is to consume or disperse 
the maximum amount of propellant at altitude. This reduces the impact area toxic hazard 
and the hazard caused by hypergolic bipropellant combinations, such as nitrogen 
tetroxide and aerozine-50, that may detonate with high yields upon high velocity impact 
with the ground. 

4.3.1.3.1.2. For liquid propellant stages using nontoxic propellants, the destruct 
charges must cause penetration of the propellant tanks, both fuel and oxidizer, to the 
extent necessary for rapid dispersion of the propellants. The intent of this 
requirement is to make sure that the maximum amount of propellant is dispersed before 
vehicle impact with the ground. This reduces the impact area hazard by reducing the 
explosive yield. 

4.3.1.3.2. For vehicles consisting of all solid propellant stages, the transmitted 
"Arm" command must be utilized only as a predestruct logic function within command 
system receiver and decoder. Thj subsequent transmitted destruct command, or activation 
of the automatic flight termination system, must cause the following: 

4.3.1.3.2.1. For solid propellant motors with propellant grain dimensions greater than 
80 percent of the critical diameter and geometry of the propellant formulation used, the 
destruct charge should ignite any nonburning grain and should destroy the pressure 
integrity of the motor. This action must cause either a condition of zero thrust, or 
any residual thrust must cause tumbling so that no significant lateral or longitudinal 
deviation of the impact point could result. Further, for propellant formulations where 
detonation in the uprange area could result in a hazardous overpressure condition, the 
destruct charge should be designed to break up, but not detonate, the propellant grain. 

4.3.1.3.2.2. For solid propellant motors, with propellant grain dimensions that are 80 
percent or less of the critical diameter or geometry of the propellant formulation used, 
and do not present a detonation overpressure condition, the destruct charge need only 



destroy the pressure integrity of the motor. This action must cause either a condition 
of zero thrust or any residual thrust must cause tumbling so that no significant lateral 
or longitudinal deviation of the impact could result. 

4.3.1.3.3. For vehicles using a combination of liquid and solid propellant stages, the 
requirements of 4,3,1,3,1 and 4,3.1.3.2 above apply. In addition, nondestructive thrust 
termination may be necessary for the solid propellant stages. The need for that 
capability will be determined by the: 

4.3.1.3.3.1. Missile launch trajectory. 

4.3.1.3.3.2. Liquid and solid propellant stage stacking sequence. 

4.3.1.3.3.3. Liquid and solid propellant stage thrusting sequence. 

IIOTE: Destruct action of one stage may cause undesirable reactions in another stage; 
therefore, detailed information relative to the above areas should be provided to 
WSMC/SEO as early in the system design period as possible for review and resolution. 

4.3.1.3.4. Propulsive systems on other than stages of the vehicles are: 

4.3.1.3.4.1. Combination solid propellant thrust augmentation with sclid propellant 
vehicles. For solid propellant thrust augmenting rockets used with solid propellant 
vehicles, the requirements of 4.3.1.3.2.1 or 4.3.1.3.2.2 above apply, as appropriate. 

4.3.1.3.4.2. Combination solid propellant thrust augmentation with liquid propellant 
vehicles. For solid propellant thrust augmenting rockets used with liquid propellant 
vehicles, the transmitted "Ann" command must cause nondestructive thrust termination of 
all thrust augmenting rockets. If the thrust augmenting rocket(s) fall within the size 
described in 4.3.1.3.2.2 above, the activation of the automatic flight termination 
system {if required) must cause the same action as the transmitted "Arm" command and no 
further action is required by the transmitted destruct command on these thrust 
augmenting rockets. If the thrust augmenting rockets fall within the size described in 
4.3,1.3,2,1 above, the transmitted destruct command or activation of the automatic 
flight termination system {if required) must cause the action described in 4.3.1.3.2.1 
above on the thrust augmenting rockets. 

4.3.1.3.5. For all other auxiliary propulsive systems, no action to the system is 
required by the transmitted "Arm" command. The transmitted destruct command, or the 
activation of automatic flight termination system (if required), must cause the sane 
action as required for stages of the vehicle having the same type fuel, 

4.3.1.3.6. For cruise or glide vehicles, flight termination action must cause a 
condition of zero lift (for example, separation of wings, control surfaces, empennage, 
or complete disintegration} and must disperse all propellents carried on board. 

4.3,1.4. Automatic flight termination systems must be designed to be activated by: 

4.3.1.4.1. Vehicle breakup or premature separation of ahy powered stage interface above 
or below the powered stage(s) containing the command System. 

4.3.1.4.2. Inadvertent separation of the command system stage if located above the last 
(uppermost) powered stage of the vehicle. 

4.3.1.4.3. Premature separation of any auxiliary propulsion system requiring an 
automatic flight termination system under 4.3.1.2.7 above. Activation of the automatic 
flight termination system on a stage or other propulsion system must result in the 
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appropriate flight termination action required by 4.3.1.3 above. "Otis precludes the 
possibility of any stage or designated auxiliary propulsive system being capable of 
powered flight without a method of flight termination. Any method that reliably 
activates the system upon inadvertent separation of the protected interfaces (for 
example; lanyard, microswitch, break wires, or similar device) is acceptable. Each 
stage or auxiliary propulsive system requiring an automatic flight termination system 
that is electrically initiated must contain a dedicated power supply or a firing 
capacitor bank to supply the energy required to initiate the flight termination 
actuating devices. The flight termination system actuating devices activated by the 
automatic flight termination system may be common with the command system devices. 
Particular emphasis must be placed on the ability of the automatic flight termination 
system to withstand forces greater than those that would lead to destruction of the 
missile stage interface it is protecting. In cases where the system could be subjected 
to the shock and heat of a prematurely separating or igniting upper stage, the system 
must be designed to survive that environment and operate with the required reliability. 

4.3.1.5, Right termination circuitry design requirements are; 

4.3.1.5.1. Flight termination circuitry must be shielded, filtered, grounded, or 
otherwise isolated to preclude the electromagnetic environment that it is operated in 
from responding to or causing interference that would inhibit and degrade the function 
of the system, cause an undesired output from the flight termination system, or 
interfere with other systems in the vehicle that could result in a hazardous situation, 

4.3.1.5.2. All flight termination systems and missile system interface components 
containing reactive elements {for example: relays, electrical rcotors, or similar 
devices) that are capable of producing transient voltages, oust be provided with 
suppression circuitry te prevent interference or damage to flight ternination control 
system conponents and other vehicle subsystems. 

4.3.1.5.3. System design must be such that the destruct action of any stage will not 
sever or damage interconnecting flight termination system electrical, mechanical, 
ordnance, or other coupling equipment to other stages until destruct action is reliably 
initiated on the other associated stages. 

4.3.1.5.4. The performance of the flight termination system (except for the affected 
monitor circuit) shall not be affected by external shorting of a monitor circuit or the 
application of any positive or negative voltage between and 35 volts to any flight 
termination monitor circuit. 

4.3.1.6. Prelaunch testing design requirements are: 

4.3.1.6.1. All circuitry, elements, components, and subsystems of the system must be 
capable of withstanding, without degradation, repetitive functioning and applications of 
electrical energy and mechanical forces incurred during prelaunch testing. 

4.3.1.6.2. Flight termination and missile system design shall provide the capability to 
perform the following receipt-through-launch testing: 

4.3.1.6.2.1, Testing under 4,5,2,1,1 below for vehicles operating under the 
"Facto ry-To-Pad" concept. 

4.3.1.6.2.2, Testing under 4.5.2,1,2 below for vehicles not operating under the 
"Facto ry-To-Pad" concept. 

4.3.1.6.2.3, Testing under 4.5,2,3. below for all vehicles. 
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4.3.1,7, System arming design requirements are: 

4.3.1.7.1. For land launched vehicles, the system must be designed so all command and 
automatic flight termination system SSA devices, except lanyard armed S$A devices, are 
armed prior to ignition. A remote method of verifying the status of each SfiA or EBW 
device must be provided. If an £M system is used, each EBW capacitor bank must be 
fully charged and the EBW system placed in the armed position prior to ignition. 

4.3.1.7.2. For land launched vehicles, the system must fie designed so all firing 
capacitors used to initiate the ordnance train in the command and automatic flight 
termination system are thoroughly tested prior to flight. A remote indication of firing 
capacitor charge voltage must be provided. 

4.3.1.7.3. For air or sea launched vehicles where propulsive ignition occurs prior to 
first motion (for example, aircraft launched vehicles), dual SSA or EBW devices must he 
used and delay time for araing the SW or EBW devices must be the minimum consistent 
with launch crew safety. 

4.3.1.7.4. For air or sea launched vehicles where propulsive ignition occurs after 
first motion, an ignition interlock must be provided so that engine ignition cannot 
occur unless: 

4.3.1.7.4.1. The S3A devices are in the armed position for mechanically araed SM 
devices. 

4.3JJ.4.2. The capacitor bank is fully charged for EBW systems. 

4.3.1.0. In some cases, it may be necessary to "safe" the ccraand or automatic flight 
termination system in flight, when the vehicle has proceeded beyond the limits of USHC 
safety responsibility or to permit noraal staging separations. In this case, the 
"safing" action is accomplished by one of the following methods: 

4.3.1.8.1. A radio message transmitted from WSMC group equipment. The optional message 
in 4.3.3.3.12 below is normally used for this purpose. 

4.3.1.8.2. An automatic function in the vehicle. Safing action in this case must 
depend on no less than two independent functions {from different sources! in the vehicle 
(for example, thrust chamber pressure decay and time from lift-off). 

4.3.1.9. System monitor functions, such as arm, optional command, destruct, signal 
strength, etc., must be taken from points in the circuits that provide adequate and 
significant data for analysis and real-time use. Isolation is to be provided so that 
faults in the monitoring input circuits do not degrade the monitored systems- A short 
or open in an input circuit or the application of any negative or positive voltage up to 
35 volts to such a circuit must not affect any other ionitor circuits, 4,3.1,5,4 above. 

4.3.1.10. Reliability requirements are: 

4.3.1.10.1. The system must he designed to positively eliminate a single point failure 
resulting in the execution of undesired flight termination action or in the failure to 
execute desired flight termination action. 

4.3.1.10.2. The flight termination system (command system and automatic system, as 
applicable) shall be designed to provide a probability of executing the required flight 
termination function of greater than 999 parts in 1,000. 

4.3.1.10.3. A reliability analysis shall be performed on all individual components, 
such as, antennas, cables, receivers, as well as the complete Range Safety System, This 
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analysis shall consist of a probability analysis, failure cause and effect analysis, and 
safety analysis. The operation and environmental parameters of each component, as well 
as the complete system, will be designed to a reliability of 99.99 percent wi;h a 
confidence factor of 95 percent. The final analysis will be presented in clear form 
with appropriate a posteriori reliability predictions and a priori reliability testing. 

Methods of System Reliability Prediction. 

(1) Event-space. 

(2) Path-tracing. 

(3) Cut set and tie set, 

(4) Boolean logic. 

(5) Fault tree analysis. 

(6) Monte Carlo simulation. 

Basic A Posteriori Reliability Prediction. 

(1) Series 

(2) Parallel 

(3) Standby 

(4) Load sharing 

(5) HultiEtode function 

(6) Conditional probability Bayes Theoren 



4.3.2. Fli< 



: termination systeia, antenna system design are described as follows: 



4.3.2.1, Adequate radio command coverage over 95 percent of the radiation sphere is 
required. To have adequate coverage, the entire command flight termination system 
(ground and airborne) oust be submitted to ait RF link analysis for the vehicle's 
trajectory where HSHC retains safety responsibility and command control action nay be 
required. The gain margin for the link analysis must exceed plus 12 dB. Ground system 
HP characteristics are shown in Flight Termination Cocmand System RF Radiation 
Characteristics (attachment 4). 

4.3.2.2, To provide vehicle antenna radiation characteristics that satisfy radio 
command coverage requirements, the antenna system may include power splitters, 
combiners, hybrids, coaxial cables, and other passive components. The antenna system may 



4.3.2.2.1. Independent for each receiver. 

4.3.2.2.2. Coupled so that the RF signal power at a single antenna system output port 
is equally divided between each receiver. 

4.3.3. Flight termination system receiver and decoder design are described as follows: 

4.3.3.1, General design requirements - minimum acceptable requirements for receivers 
and decoders provide for standardization of receivers and decoders, compatibility with 
SIC ground systems, efficient use of the assigned spectrum, and minimized 
susceptibility to interfering signals. The establishment of these requirements is not 
intended to restrict receiver and decoder design. Where the state-of-the-art permits 
improvement over these requirements, such improvements should be incorporated. 

4.3.3.2, Command transmitter specifications - transmitter site geodetic coordinates and 
RF radiation characteristics are provided in attachment 4 (Flight Termination Command 
System RF Radiation Characteristics). 
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4,3.3.3. Receiver and decoder minimum specification - receivers and decoders must meet 
the minimum requirements for temperate) e and other environmental conditions they are 
subjected to during prelaunch checkout and flight. 

(.3.3.3,1. Receiver and decoder WSKC interface - the receiver and decoder shall be 
designed to reliably receive and decode WSMC-transmitted radio command signals and 
actuate flight termination system devices. 

4.3.3.3.2. Frequency band - the receiver shall be tunable to 416.5 MHz or 406.5 MHz. 
All new programs at WSMC are usually assigned 416.5 MHz (the primary frequency). 

4.3.3.3.3. Deviation - the receiver and decoder shall operate normally with a deviation 
of plus and minus 30 kHz per tone with a tolerance of plus and minus 10 percent. The 
receiver and decoder shall not produce a decoder output at deviation levels of plus and 



4.3.3.3.4. Sensitivity - the receiver shall have adequate sensitivity to maintain at 
least 1-12 dB gain margin through the end of powered flight or orbit insertion, 4.3.2.1 



4.3.3.3.5, Maximum usable RF input - the receiver and decoder shall be capable of 
operating within specification limits before, during, and after the application of a 1 
volt RMS RF signal to its RF input. 

4.3.3.3.6, Operating bandwidth - the receiver and decoder shall respond normally to all 
valid commands with the carrier frequency shifted within a minimum of plus and minus 45 
kHz from the assigned operating frequency at an RF level equal to the specified 
sensitivity over the operating temperature range. 

4.3.3.3.7, Continuous Have (CH) RF bandwidth - the response to a Ctt signal at the 
assigned center frequency shall be 60 dB or more than the response at plus or minus 100 
kHz from the assigned center frequency. CH rejection outside this bandwidth shall be 
greater than 60 dB. Note that this requirement is in reference to the assigned center 
frequency, and is not satisfied with a 360 kHz bandpass (unless the 360 kHz"is exactly 
centered on F). 

4.3.3.3.0. Hoi se margin - the AC noise level present at any point in the receiver 
capable of producing a logic function or command output must be 12 dB less than that 
which would cause the switching or activation levels for such circuits. A like margin 
is required for the DC circuitry. 

4.3.3.3.9. CH peak to valley ratio - the peak to valley ratio must not exceed 3 dB 
within plus and minus 45 kHz from the assigned operating frequency. 

4.3.3.3.10. Decoder or tones and frequencies - the decoder must be capable of 
processing four tones with center frequencies of: 

Tone 1 (7.50 kHz) 
Tone I (8,46 kHz) 
Tone 4 (10J6kHz) 
Tone 5 (12.14 kHz) 

4.3.3.3.11. Decoder channel bandwidth - the 2 dB bandwidth of each decoder channel must 
not be less than plus and minus 1 percent of the assigned tone center frequency. The 20 
dB bandwidth of each decoder channel must not be greater than plus and minus 4 percent 
of the tone assigned center frequency. 
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4.3.3.3.12. Decoder outputs - the decoder provides four distinct and separate outputs. 
The outputs, in the form of electrical energy, are termed optional, an, destruct, and 
monitor or check channel. The tones and logic sequence required to produce the decoder 
outputs are: 



Decoder Output 


Tojiejjjgic 


Optional 


Tones I and 5 
and not 1 


Am 


Tones 1 and 5 


Destruct 


Tones 1 and 5 (Ami) 
followed by tones 1 
and 2 and not 5 



Monitor or check channel Tone 4 



Note 2; After initiation of the am output, the removal of tone 5, required for 
destruct output, must not result in the discontinuance of the arm output, nor should the 
removal of tone 5 prior to application of tone 2 inhibit the output of destruct. 
Therefore, tone 1 is the logic locking tone, and once initiated, the arm and destruct 
output continues until tone 1 is removed. 

Mote 3: The optional, are, and destruct output electrical energy mist meet the 
requirements specified for activation of the associated flight termination devices. The 
check channel output shall be capable of providing a minimum of two watts of power to 
the external load. 

4.3.3.3.13. Response time - the tirce interval between the appearance cf the last tone 
of a tone pair at the front end of the receiver and the occurrence of the respective 
decoder output must not exceed 15 milliseconds. 

4.3.3.3.14, Output connectors - commands such as arm, optional command, and destruct 
shall be routed through a connector separate from all other circuits. 

4,3,3.3,15- New technology - in the event a particular receiver design incorporates any 
new and substantially different technology, such as, but not limited to, digital signal 
processing, microprocessor control, solid state switching devices, phase lock loops, 
etc., all performance criteria set forth in this document must be met without 
compromise, in addition, no new anomalies or abnormal operations are allowed to occur. 
Error detection and correction techniques, or other means, must be used to prevent 
single-point failure modes, and any failure should be to a failsafe state. The design 
must not be susceptible to environmentally induced failures. Precautions should also be 
taken to prevent turn on and off glitches, entering an endless loop, and to provide for 
return to the main program in the event of a bad memory location. 

4.3.3.3.16. Signal strength monitor - an RF input signal equal to the receiver's 
nominal (guaranteed) sensitivity level shall produce a DC voltage output, fcr monitoring 
purposes, that is discernable above the receiver's quiescent state output and is a 0.2 
to 0.3 volt increase above the quiescent level. The monitor level shall -hen increase 
at a rate of approximately 1 volt for each 13 dB increase in the RF level. The DC 
output level shall reach a maximum (saturation) of between 4.5 to 5.0 volt;' with no less 
than 500 microvolts of RF applied. This output is either positive or negative and must 
not be ambiguous. It must permit a reasonable evaluation of incoming sigral strengths 
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from 3 to 300 microvolts with no gross discontinuities in the response curve. The 
quiescent level, with no RF input to the receiver, must be a maximum of 0.5 volts. The 
load is assumed to be 1 OK ohm unless otherwise specified. The time constant must be 0.1 
second or less. 

■ failure of any one component must not cause a 



4.3.3.3.18. Performance - after being adjusted initially, the receiver and decoder must 
perform according to the requirements in the manual without subsequent adjustment. 

4.3.3.3.19. Interference - the receiver and decoder must be designed to meet the 
requirements of MIL-STD-4618, methods CE01, CE03, CE06, CE07, CSQ1, CS02, CS03, CS04, 
CS05, CS06, CS07, RE02, RS02, and RS03, Limits A and B of MIL-STD 4618, figure 2-5, are 
changed to 60 dB above threshold at f . In addition, limit S must be at least dB m 
throughout the following frequency ranges: 2200-2300 MHz, 56OO-E8O0 MHz and 9200-9600 



NOTE: Extreme environmental considerations in a given vehicle may require test limits 
more stringent than those called out in MIL-STD-461B, and conversely, lesser Merits may 
be adequate in other vehicles; therefore, an analysis of the emitted radiations, and the 
susceptiblity of the receiver and decoder to interference, must be performed at the 
system level to establish that the interference characteristics identified and profiled 
in testing are compatible with the environment of the vehicle the receiver and decoder 
are to be used in. 

4.3.3.3.20. Input requirements - the input voltage range must be specified, and the 
current in the commanded and unconmanded state noted in the specification. 



4.3.3.3.21. Capture ratio - the application of an unmodulated RF signal at the assigned 
frequency of up to 80 percent of the desired modulated RF carrier must not cause the 
receiver to fail to meet the requirements of 4.3,3,3,4 above. 

4.3.3.3.22. Abnormal voltage tolerance - the receiver must not produce an inadvertent 
command output because of input voltage below the minimum, or because of fluctuations of 
the input voltage. The receiver must not be damaged by such fluctuations. 

4.3.3.3.23. Resistance and isolation - the resistance from each pin to common return, 
and also case ground, must be specified. Measurements that are polarity sensitive, such 
as those containing diodes, etc., shall be identified. In addition, significant pin to 
pin measurements shall be included where their inclusion will provide meaningful data 
relative to the reliability of the receiver. 

4.3.3.3.24. Transient response - the tolerance to transient voltages shall be specified 
for each connector pin. Amplitude, polarity, and duration shall be identified. The 
ability of the receiver to meet the requirements of 4.3.3.3 above after the application 
of the specified transient, and that no output is produced during the transient, is 
required. 

4.3.3.3.25. AM rejection - an RF input signal, at the operating frequency, specified in 
4.3.3.3.2 above, of 7 microvolts + 10 percent with 30 percent AM modulation and a 12 
microvolt + 10 percent signal with" SO percent modulation at any modulation frequency 
shall not produce an output from any decoder channel. 
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4.3.3.3.25.1. One hundred percent AH rejection - an RF input signal at the operating 
frequency specified in 4.3.3.3.2 above of 100 microvolts + 10 percent with 100 percent 
peak m noise modulation at LPF 3 dB frequencies of 3,5 kHz or 7,0 kKz, shall not 
produce an output from any decoder channel. When the input signal is properly modulated 
to produce an output from a decoder channel, the 100 percent peak AH noise modulation at 
LPF 3 dB frequencies of 3.5 kfe to 7.0 kHz shall not inhibit that decoder input. 

4,3,4. Flight termination systei S&A or EBH device design requirements are: 

i devices must meet the requirements of 



4.3.4.2, For S&A devices, the remote armed indication shall not appear unless the 
device is in a position where the explosive ordnance train is 98 percent aligned, the 
ordnance barrier is 98 percent clear of a fully aligned ordnance train, or the overall 
alignment is such that the required system reliability and confidence level can be 
verified. 

4.3.4.3, The S&i device shall be configured with dedicated connectors for redundant 
initiators (for example, initiating trains, including squibs, primers, and boosters) 
that are electrically and pyrotechnically independent of each other. Ordnance 
crossovers sr& not prohibited, provided overall reliability is maintained- Ordnance 
contained in flight termination system SSA devices shall meet the requirements of 4.3,5 
below 

4.3.4.4, Flight termination system SSA devices armed after vehicle first motion 
[lanyard, inertial, or similar device] shall be capable of being cycled to the am 
position for checkout purposes prior to installation. 

4.3.4.5, Flight termination system S£A device design must be compatible with the system 
arming requirements contained in 4.3.1.7 above 

4.3.4.6, For EBW devices, the remote charged indication shall not appear unless the 
capacitor bank(s) is (are) 85 percent charged, or the overall system alignment is such 
that the required system reliability and confidence level can be verified. 



4,3,5. Flight termination system destruct ordnance design requirements are: 

4.3.5,3. The destruct ordnance train shall be designed to reliably initiate with the 
energy provided by the command or automatic flight termination systemfs) initiating 
circuitry. Whon initiated, the destruct action shall reliably propagate through the 
ordnance train, initiate destruct charges, and result in the appropriate destruct actior 
required by 4.3.1.3 above. 

4.3.5.2. Destruct ordnance shall be designed with particular emphasis on the 
requirements of 4.3.1.1 above. Tests on solid rocket motor destruct charges (linear 
shaped charges), containing 180 grains per foot waxed ROX, have shown that heat fluxes, 
greater than 100 Bill per ft per sec, can cause charge ignition and high order detonatioi 
in less than one second. The fact that upper stage exhaust during staging may engulf 
destruct charges and cause heat fluxes that exceed levels mentioned above should be 
carefully considered in the charge design for solid motors. 

4.3.5.3. Destruct ordnance shall be designed to meet the requirements of chapter 3. 
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4.3.5.4. Maximum effort shall be made to design destruct ordnance in a configuration 
that enables initiators or other sensitive explosive components to be installed or 
connected late in the launch countdown through easily accessible openings in the vehicle. 

4.3.5.5. Flight termination control system ordnance component total life, including 
shelf, installed, and service life under specified environmental conditions, is 
determined on an individual system basis. It is based on the age and the deterioration 
rate of each component Once defined, extensions of shelf-life over one year nay 
require requalification testing. 

4.3.6. Flight termination system power supply design requirements are: 

4.3.6.1. Airborne power supplies for the flight termination system shall be designed to 
preclude a short in, or failure of, any one battery causing a failure of the flight 
termination system. The batteries used in the flight termination system shall be 
independent of all other systems, including each other. 

4.3.6.2. Batteries shall be of sufficient capacity to provide life for load and 
activation checks, launch countdown checks, and any necessary hold titae so that at 
launch, sufficient battery life remains for flight, to the limits of WSMC/SE 
responsibility, plus 10 percent of the rated battery anpere hour capacity. For vehicles 
using solid propellants, a minimum of 30 additional minutes of battery life shall 6<? 
provided so that flight termination action is possible until positive safing can be 
effected against inadvertent launch in case of hangfire or misfire condition. 

4.3.6.3. The batteries should be easily accessible for inspection anc" replacement. 

4.3.7. For flight termination system in-flight telemetry design, sufficient system data 
shall be telemetered to determine the adequacy of the flight termination system 
throughout powered flight and to aid in preflight and postflight analysis. TM data 
includes, but is not limited to, the following: 

4.3.7.1. Flight termination control system: 

4.3.7.1.1. Each command receiver and decoder discrete function output (optional 
command, arm, destruct, and check channel 4). 

4.3.7.1.2. Each comand receiver signal strength voltage (AGC), 

NOTE: The destruct function output may be incorporated with the signal strength voltage 
telemetry channel. If so incorporated, the destruct function must cause signal strength 
voltage to rise a nriniaiun 0.5 volts above the nondestruct AGC voltage. 

4.3.7.1.3. Status of each $ftft device. 

4.3.7.1.4. Each power source voltage associated with the flight termination sy-teia, 

4.3.7.1.5. Each firing unit logic voltage, high voltage, and trigger voltage for 
exploding bridge wire {EBW} systems, 

4.3.7.1.6. Current of each power source associated with the flight termination system. 



4.3.7.2. Telemetry identificatioi 
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4.3.7.2.1. Range users shall provide a telemetry measurement listing in the program 
requirements document (PRD) or operations requirement document {OR}. HSMC/SEO 
identifies the individual measurements to be used by review of these documents and any 
other available listings, Final decisions are made by WSHC/5E0 to specifically identify 
which telemetry channels are mandatory and which are desired, 

4.3.7.2.2. Calibration data on demodulated telemetry measurements are to be provided by 
the Range user to MSMC/SEO on request. The performance parameters are referenced 
against voltage levels for strip chart display and operator interpolation. 

4.3.8, Flight termination ground systems design: 



4.3.8.2. A destruct simulator shall be provided for all comancf and automatic destruct 
system tests, wet dress rehearsals, combined system tests, countdown demonstration 
tests, or similar tests including the system tests required by this regulation. This 
simulator is to remain connected on the missile from the commencement of final prelaunch 
tests and launch day tests until the electrical connection of the flight initiators is 
accomplished. The simulator must provide: 

4.3.8.2.1. Termination of the firing circuit with a device whose electrical 
characteristics match the electrical characteristics of the actual initiator. It shall 
be capable of providing certification of destruct surefire current, 

4.3.8.2.2. A stray current monitor device (for example, fuse or automate recording 
system) capable of indicating a minimum of one-tenth of the tiaxitnm no-fire current. It 
shall be connected and functional at all times, except when a demonstration of 
destructor surefire current is required. 

4.3.8.3. A flight termination system control console shall be provided and naintained 
hy the Range user. It shall be located in the launch control center, in a position that 
provides a viewing capability of the countdown time indicator and either the launch 
contnN'er's console or the launch sequencer control consols(s), as applicable. 
Physical size and design of the control console must provide seating accomodations for 
two persons with access to the console controls and monitors by either person. This 
console is designpri to provide monitor and control capability for one person designated 
by the Range user to perform tasks defined by approved test procedures including 
countdown and launch nanuals. The second position at this console is occupied by the 
RHCR. The RHCR supoorts test operations by analyzing system performance and evaluating 
flight readiness and also acts as the WSHC and Range user interface for resolution of 
flight safety probleos. The RHCR also provides coordination of the final 
ready-to-launch system acceptance issued by the MFCO. 

4.3.0.3.1. ] he following controls and monitors shall be provided on the control console: 

4.3.8.3.1.1. Signal strength voltage (AGC) of each command receiver. 

4.3.8.3.1.2. Controls and monitors for command receiver and decoder operation {ON and 
OFF, airborne and ground power mode). 

4.3.8.3.1.3. Sensors to monitor each flight termination control system battery, bus, 
and ground power supply voltage (command and automatic, where applicable). Direct 
readouts are preferred; however, the option exists to provide either these or voltage 
comparator circuits with status lights. 



4.3.8.3.1.4. Direct readout sensors to monitor the flight termination system EBH 
capacitor, automatic flight termination system firing capacitor charge, trigger and 
logic monitor voltages (where applicable). 



4.3.8.3.1.7. Monitors for each command function at the terminal device. 

4.3.8.3.1.8. Monitors for the decoder outputs of each receiver and decod 



4.3.8.3.1.10. Certain flight termination system controls, such as receiver power 
switches, SSA devices, or similar devices in the console must be capable of being locked 
or safed to the Off position if they are considered to be a safety hazard by KSHC/SEO. 

4.3.8.3.1. 11. Hold-fire capability that prevents ignition by stopping the launch 
sequencer or interrupting the ignition circuit. This capability must exist down to 
ignition. The control of this device is subject to predefined HSHC and Range user 
agreements. 

4.3.8.3.1.12. Status and alert signaling system to activate status and alert recote 
display on the HFCO console to indicate "GO" or "IIO-GO" status of the airborne flight 
termination system. 

4.3.8.3.1.13. Manually activated lift-off switch to provide backup lift-off signal at 
missile launch and to permit prelaunch testing of missile lift-off interface to «5MC 
instrumentation- The option exists to locate this manual function elsewhere in the 
launch control center. It shall be activated by the launch crew member specified in the 
countdown manual. 

d monitors aust be continuously available or 

4.4. Right Termination System Manufacture. By its very nature, the flight termination 
system must be of the highest reliability. The consequences of this system failing to 
operate when required are extremely severe. This high reliability is ensured by placing 
the appropriate design and testing requirements on the individual components and on the 
system comprised of these components. Such reliability can be compromised if the flight 
termination system components are not subject to rigorous review and control during the 
manufacturing process. 

4.4.1. The electronic-piece parts and materials used in the manufacture of flight 
termination system components must be of "Space quality," as defined in WL-STD-1547, 
and capable of meeting the general and detailed requirements set forth there. 

4.4.2. The manufacturer of flight termination system components must have a quality 
program to make sure all machining, wiring, batching, shaping, soldering, bade 
production operations of any type, and processing and fabricating of any type is 
accomplished under controlled conditions. Controlled conditions include documented work 
instructions, adequate production equipment, and any special working environment. 
Documented work instructions are considered to be the criteria for much of the 
production, processing, and fabrication work. Some of these instructions are also the 
criteria for acceptable or unacceptable workmanship. 
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4.5. Flight Termination System Testing: 

4.5.1. Flight termination system qualification testing shall be as follows: 

4.5.1.1. System testing - all components of the flight termination system and methods 
of attaching or installing the system (command and automatic) must be tested to make 
sure of their environmental survivability (paragraph 4.3,1.1}. 

4.5.1.2. Reliability testing - the capability of the flight termination system to 
satisfy the requirements of 4,3,1,15 above shall be demonstrated by the Range users' 
analyses and tests. 



4.5.1.3. Antenna testing - tests shall be performed to verify the antenna i 
compatibility with the receivers and to provide data for the RF link analysis (paragraph 
4.3.2} and for the antenna patterns (paragraph 4.7.1.3,3). 

4.5.1.4. Coitfand receiver and decoder testing - receivers and decoders that have not 
been previously certified for use at WSHC must undergo qualification tests according to 
RCCRSG Document 313-80 and 4.2.2 above. Further, command receivers and decoders, 
certified for use at HSHC with a particular vehicle, may require additional 
qualification tests if the receiver and decoder are used with a different type launch 
vehicle. The qualification testing of two receiver and decoder units may be conducted 
by an independent agency or by the receiver and decoder vendor. The identification of 
the test agency is determined on a case-by-case basis through joint VSHC and Range user 
agreement. In addition, certain tests are performed to assure compatibility with 
specific HSHC ground systems, sissile systems, and HSMC flight methodology. Testing by 
USHC is according to a test plan developed in joint agreement between HSHC/SEQ and the 
Range user. Further, tests conducted by HSHC will not include any testing that 
precludes future use of the test receivers as flight articles. The Range user is 
responsible for supplying two receivers to HSMC for testing. 

4.5.1.5. im, m, and S&A device testing: 

4.5.1.5.1. All EBH , Iffitf, and SSA devices must meet the requirements of chapter 3 and 



4.5.1.5.3. Devices that are araed by lanyard or a similar device must be capable of 
being switched to the arm position for checkout purposes. 

4.5.1.6. Ordnance testing - tests must be performed to show the capability of the 
destruct charges to accomplish the destruct action required by 4.3.1.3. above. 

4.5.1.7. Power supply testing - tests and analyses must be performed to determine 
battery-load life considering the loads that will he imposed during battery activation, 
load tests, prelaunch system tests, destruct tests, countdown, hold tine, and flight. 
Provision must be made for misfire and hangfire situations. 

4.5.1.0, Associated component testing - tests of other flight termination system 
components not specifically called out in this regulation m tailored to those 
components with test criteria suitable to Rake sure of adequate performance at the 
required system reliability level results. 

4.5.1.9. Flight termination system modification ^qualification testing < retesting is 
required when significant modifications or changes are made (paragraph 4.2,5} to the 
system or components that require specific qualification testing. The requirements for 



retest depend on the extent and type of modifications being made, and are determined by 
OC/SEG through joint WSMC and Range user consideration on a case-by-case basis. 

4.5.Z. Receipt through launch testing: 

4.5.2.1. Radio command link - normally, the antenna, receivers and decoders of the 
radio command link are tested both individually and as a systei at WSHC as part of the 
vehicle's receipt through launch readiness sequence testing. However, where mission 
requirements, economy, or special circumstances prevail, a concept termed 
"factory-to-pad" may be authorized for Range users whose launch vehicle assembly 
facility is not located at WSHC* This concept permits some of the testing, normally 
done at KSMC, to be accomplished at the vehicle assembly facility, with reverification 
testing at USHC. Authorization to conduct testing under the factory-to-pad concept 
requires a waiver obtained according to 4.2.1 and 1.7 above. The requirements for both 
the factory-to-pad and nonfactory-to-pad (all testing at WSMC) test methods are 
specified as follows: 

4.5.2.1.1. Factory-to-pad: 

4.5.2.1.1.1. The following tests are performed at the launch vehicle assembly facility: 

4.5.2.1.1.1.1. Each receiver and decoder is performance tested in a laboratory type 
environment prior to final installation of the units into the launch vehicle. The tests 
determine the following performance characteristics; 

4.5.2.1.1.1.1.1. Receiver and decoder RF sensitivity for optional, arm, destruct, and 
monitor messages at the srinimum, nominal, and maximum DC voltage input (paragraph 
4.3.3.3.1). 

4.5.2.1.1.1.1.2. Sixty M CW bandwidth (paragraph 4.3.3.3.7). 

4.5.2.1.1.1.1.3. Operating bandwidth also includes a test in a ffl characteristic mode 
to determine if any peaks or valleys exist within the operational bandwidth (paragraphs 
4.3.3.3.6 and 4.3.3.3.9). 

4.5.2.1.1.1.1.4. Deviation sensitivity and compatibility (paragraph 4.3.3.3.3). 

4.5.2.1.1.1.1.5. Each decoder channel tested for 2 and 20 dB bandwidth on the receiver 
and decoder (paragraph 4.3.3.3.11). 

NOTE: For receiver or decoders susceptible to overdeviation at the 20 dS level, the 20 
dB bandwidth measurement will be made prior to installation of the filter into the 
decoder. The test will be repeated in the receipt-through-launch testing at a level as 
near as possible to 20 dB that will not result in overdeviation of the receiver or 
decoder. 

4.5.2.1.1.1.1.6. Decoder abnormal logic compatibility (paragraph 4.3.3.3,12). 

4.5.2.1.1.1.1.7. Response time (paragraph 4.3.3.3.13). 

4.5.2.1.1.1.1.8. Isolation and input current (paragraphs 4.3.3.3.20 and 4.3.3.3.23). 
r for optional, arm, destruct, and 



4.5.2.1.1.1.1.10. Usable RF input (paragraph 4.3.3.3.5). 

4.5.2.1.1.1.1.11. Capture ratio (paragraph 4.3.3.3.21). 
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4.5.2.1.1.1.1. 12. Relative signal strength curve. 

4.5.2.1.1.1.1.13. AM modulation rejection (paragraph 4.3.3.3.25). 

NOTE: Additionally, other test areas May be required, dependent on any unique or 
additional missile system or receiver and decoder requirements. 

4.5.2.1.1.1.2. A voltage standing wave ratio (VSWR) test is performed on the antenna 
system of each launch vehicle. 

4.5.2.1.1.1.3. An in-vehicle RF system sensitivity test is conducted after the 
receivers and decoders are installed into the vehicle and connected to the antenna 
system. The test is conducted in an RF closed loop node utilizing a calibrated RF cable 
and calibrated antenna couplers (hats). The test determines the RF sensitivity, 
referenced to the surface of each antenna, for each receiver and decoder output of an 
optional, arm, destruct, and monitor message. Tire receiver and decoder DC voltage 
supply is at its nominal value. 

4.5.2.1.1.2, An in-vehicle receiver and decoder performance test is conducted at HSHC. 
The test is perfonned as late in the receipt through launch readiness sequence as 
possible (normally within % days of launch). The test is conducted in the RF closed 
loop mode utilizing a calibrated ftF cable and calibrated antenna couplers provided by 
the Range user. The test is performed by NSKC Center Technical Services Contractor 
(CISC). The performance characteristics derived from this test are compared with the 
characteristics derived from the tests at the launch vehicle assembly facility. If no 
significant differences are noted (test equipment tolerance factors considered), 
the RF command link systeia is considered acceptable and undamaged by vehicle shipment or 
Storage. Any change of components or disconnection of any portion of the RF command 
link subsequent to this test requires complete retestiitg. The test determines the 
following performance characteristics: 

4.5.2.1.1.2.1. The RF sensitivity, referenced to the surface of each antenna, for each 
receiver and decoder output of an optional, arm, destruct, and monitor message. The 
receiver and decoder DC voltage supply is at its nominal value. 

4.5.2.1.1.2.2. Sixty dB CH bandwidth for receiver and decoder. 

4.5.2.1.1.2.3. Operating bandwidth for receiver and decoder. 

4.5.2.1.1.2.4. Deviation sensitivity and compatibility for receiver and decoder. 

4.5.2.1.1.2.5. Each decoder channel tested for 2 and 20 dB bandwidth on the receiver 
and decoder. 

NOTE: For receivers or decoders susceptible to overdeviation at the 20 dB level, the 20 
dB bandwidth measurement will be made prior to installation of the filter into the 
decoder. The test will be repeated in the receipt through launch testing at a level as 
near as possible to 20 dB that will not result in overdeviation of the receiver or 
decoder. 

4.5.2.1.1.2.6. Decoder abnormal logic compatibility of each receiver and decoder. 



4.5,2.1.1.2.8. Amplitude modulation rejection testing at 100 percent. 

NOTE; Additionally, other testing areas may be required, dependent on any unique or 
additional missile system or receiver and decoder requirements. 
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4,5.2.1.2, For nonfactory-io-pad, the fallowing tests must te performed it HSHC: 

4.5.2.1.2.1. A VSHR test is performed on the antenna system of each launch vehicle. 

4.5.2.1.2.2. Each receiver and decoder Is performance tested at the HSHC RF 
Measurements Laboratory. The test Is performed as late in the receipt through launch 
readiness sequence as possible {normally within 90 days of launch). The tests determine 
the following performance characteristics: 



4.5.2.1.2.2.2. Sixty dB CM bandwidth. 

4.5.2.1.2.2.3. Operating bandwidth - this also includes a test In a Of characteristic 
node to determine if any peaks or valleys exist within the operating bandwidth 
(paragraphs 4.3.3.3.6 and 4.3.3.3.9). 

4.5.2.3.2.2.4. Deviation sensitivity and compatibility (paragraph 4.3.3.3.3). 



NOTE: For receiver and decoders susceptible to overdeviation at the 20 dB level, the 20 
dB bandwidth measureaent will be made prior to installation of the filter Into the 
decoder. The test will be repeated in the receipt through launch testing at s level as 
near as possible to 20 dB that will not result in overdeviation of the receiver or 
decoder. 

4.5.2.1.2.2.6. Decoder abnonnal logic cmpatfbfllty (paragraph 4.3.3.3.12). 

4.5.2.1.2.2.7. Response tine (paragraph 4.3.3.3.13). 

4.5.2.1.2.2.8. Isolation and input current (paragraphs 4.3.3.3,20 and 4.3.3.3.23). 

4.5.2.1.2.2.9. Decoder output electrical energy for optional, arm, destruct, and 
monitor (paragraph 4.3.3.3,12, Note 3), 

4.5.2.1.2.2.10. Usable RF input (paragraph 4.3.3.3.5). 

4.5.2.1.2.2.11. Capture ratio (paragraph 4.3.3.3.211. 

4.5.2.1.2.2.12. Relative signal strength curve [paragraph 4.3.3.3.16). 

4.5.2.1.2.2.13. Amplitude modulation rejection at 100 percent (paragraph 4.3.3.3.25). 

MOTE: Additionally, other testing areas may be required depending on unique or 
additional missile system or receiver and decoder requirements. 

4.5,2,1.2.3. A coiunand link RF sensitivity test must be performed after final 
installation of the receivers and decoders and their connection to the antenna system. 
The test is conducted in an RF closed loop mode utilizing a calibrated RF cable and 
calibrated antenna couplers (hats) furnished by the Range user. The test is performed 
by HSHC RF laboratory personnel utilizing thu RF measurements laboratory iiobile test 
nan. The test determines the RF sensitivity, referenced to the surface of each antenna, 
for each receiver and decoder output of optional, arm, destruct, and monitor message. 
The receiver and decoder DC voltage supply is at Its nominal level. 
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4,5.2.2, EBW systems or S4A device testing requirements: 



4.5.2.2.1. A quality assurance check will be made on all S*A and EBW devices. This 
test must be performed at KSHC and consists of a physical check for signs of corrosion, 
or similar defects, general physical inspection and electrical check that includes 
arming and safing voltages, continuity, and resistance checks in both the "anned and 
safe" positions to make sure initiators are neither shorted nor open circuited. This 
check must be accomplished within five calendar days of Installation of the SJA or EBW 
devices on the vehicle,. 

4.5.2.2.2. If the flight termination system SJA and EBU devices have been electrically 
connected and the test subsequently scrubbed, a removal and recheck of the device may be 
required. Any decision to remove or recheck is coordinated with the Range user and 
depends on: 

4.5.2.2.2.1, Flight termination system missile interface design (for example, if 
removal is necessary for retest of the flight termination system). 

4.5.2.2.2.2. Hazards involved by leaving the device on the raissile during recycle. 



4.5,2.2,2,4, Previous history and reliability of the device. 

4.5.2.3. A verification check of the entire flight termination control system must be 
accomplished on each vehicle after the systea nas been completely installed and all 
connections made (the destruct simulators will substitute for the destruct initiators), 
it includes, as applicable to each particular vehicle, a check of the command system, 
automatic system, fall safe system, hoi df 1 re device, lift-off switch, and status and 
alert lights. The command system check is performed on internal power (flight 
batteries) in an RF open loop mode with the HSKC ground transmitting equipment. For the 
automatic system and fall safe systen check, the option exists to perform the check on 
Flight batteries or to perform a separate load check on those batteries. The purpose of 
the verification check is to determine proper operation and readiness of all components 
and elements of the system, Including ground transmitting equipment, vehicle receiver 
and decoders, flight batteries, nondestructive thrust termination actuating devices, and 
circuitry to the point where the destruct initiators nIII be electrically connected. 
Verification checks are incorporated into the Range user's countdown so they are 
conducted as close to lift-off as is feasible. Ideally, the verification checks and 
subsequent connection of the destruct initiators should be the last two tasks 
accomplished prior to clearing the launch pad for launch. Time sequencing of the 
verification checks Into the launch countdown is determined through joint HSHC and Range 
user consideration as part of the flight termination system approval. 

4.5,2,3.1. If, after the verification checks have been completed during the initial 
launch countdown, launch Is postponed beyond the launch window tine (for example, a 24 
hour launch slip), the Range user shall include provisions for reacconplishpent of the 
verification check in the subsequent countdown. It is recognized, however, that sow 
Range users may not be able to accomplish a complete verification check within a short 
tine frame launch recycle. In this instance, the system may be revalidated by the 
accompli shnent of a limited verification check. This limited verification check concept 
is acceptable only where a rescheduled launch window could not be met because of the 
time Involved to configure the missile system, perform the verification check, and 
reconfigure the missile for launch. WSHC/SEO ray designate a missile system as a 
limited verification check vehicle during the system design period through joint WSMC 
and Range user determination. At this time, the details and extent of the limited 
verification checks are fully Identified so that any special additions or capabilities 
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necessary to accomplish the limited verification checks can be incorporated into system 
design. Further, prior to flight termination system approval, complete WSMC and Range 
user agreement must be reached outlining the conditions where limited verification 
checks will be accepted in lieu of a complete verification check. These conditions, as 
agreed to, become part of the flight termination system approval. As vi th the complete 
verification check, the limited verification tests are incorporated into the Range 
user's countdown so they are conducted as close to lift-off as feasible. Accomplishment 
of a limited verification check may not be acceptable if the system has been compromised 
(for example, an anomaly affecting range safety, radiation considerations, the 
disconnection or replacement of certain flight termination system components, or adverse 
environmental conditions such as moisture or temperature that have the potential to 
degrade system performance). Should additional launch postponements occur beyond the 
initial 24 hour postponement, WSMC/SEO evaluates available information and determines if 
the full scale system test must be repeated or if the limited verification test is 
adequate. 

4.5.2.4, All manually activated batteries for use with flight termination systems are 
activated (built-up) at WSHC. The build-up procedure includes necessary testing to make 
sure of proper battery activation. The time interval between the test and launch 
lift-off must not exceed the activated stand time battery specification. Final 
readiness tests for both manually and remotely activated batteries are accomplished 
during the system verification check. 

4.5.2.5. Test equipment calibration - equipment used for checkout of the flight 
termination system must be calibrated on a periodic basis. This calibration must be 
accomplished on all test equipment used to support tests and certifications associated 
with processing, launch, and flight of missiles at HSKC The equipment of concern 
includes, but is not limited to, the pad safety console, the flight termination control 
system console, other blockhouse consoles, antenna couplers [hats], calibrated coaxial 
cables used for RF sensitivity, and insertion loss tests. Standard test equipment should 
be routinely checked by the local precision measurements equipment lab (PHEL); 
specialized or dedicated mock-up or portable, prograi-peculiar equipment is checked by 
HSHC (RF measurements laboratory), the Range user's approved facility, or equivalent 
agency. 

4.6. Test Attendance Requirements. A representative of WSHC/SEO will attend certain 
system and component level flight termination system recurring tests, installation 
functions, and missile system operations. For preliminary planning purposes, the 
general group of tests, installation functions, and operations that may require 
attendance are listed below. For complete clarification, the firm requirements that 
apply to each missile system program are specified by separate correspondence to each 
Range user by WSHC/SEO. Such correspondence identifies tests that require mandatory or 
optional attendance, that are to be attended on a surveillance basis only, and that 
require only notification action for scheduling purposes. 

6.1. Command receiver and decoder performance test. 

6.2. Range safety transponder performance test* 

6.3. Antenna system VSWR and RF insertion loss test. 

.6.4. RF closed loop antenna and receiver system RF sensitivity test. 
,6,5, Premature separation (automatic system) operation test. 
Flight termination system associated ground system test. 
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4.6,7. Preliminary flight termination system RF open loop test. (This is not a WSHC 
required test. However, the HSMC user normally conducts several of these tests during 
the missile receipt through launch process.} 

4.6.0. lattery activation and load test, 

4.6.9, SSA device test. 

4.6.10, Flight termination system installation inspection. 

4.6.11, Launch countdown flight termination system RF open loop test. 

4.6.12, Destruct ordnance final connection and preanring function. 

4.6.13, Launch control center functions during launch terminal countdown. 

4.7. Data Requirements. OD Form 1664, Data Item Description (LRA), is used to identify 
specific program requirements whenever possible. 

4.7.1. The following data must be submitted in support of a flight termination system 
proposal. All schematics, functional diagrams, and operational manuals must have 
well-defined, standard Institute of Electrical and Electronics Engineers (IEEE) or 
HE-SPEC terminology and symbols. 

4.7,1.1. Design data requirements are as follows: 

4.7.1,1.1. Right system data requirements are: 

4.7.1.1.1.1. Diagrams showing the location of all flight termination system components 
on the vehicle, and a block diagram of the entire system showing the location of each 
component and element in the vehicle. 

4.7.1.1.1.2. Detailed schematics and functional diagrams of all system and subsystems 
including: 

4.7.1.1.1.2.1. AH components, power sources, relay resistors, diodes, switching 
devices, connectors with pin numbers, including manufacturer specifications and 
tolerances. 

4.7.1.1.1.2.2. Other missile system components or elements that interface with, or 
share common usage with, the flight termination system (for example, engine shut down 



4.7.1.1.1.2.3. Illustrated breakdown drawings of all mechanically operated components, 
including composition and tolerances. 

4.7,1.1,1.3. Detailed function description of the operations of each component the of 



4.7.1.1.1.4. Data showing compliance with guidelines set forth in HIL-STD 785A, 

4.7.1.1.1.5. Identify reliability model input and apportionment and prediction for all 
system components and elements. 

4.7.1.1.1.6. Identify reliability of all system components and elements executing a 
required system function. 
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4.7.1.1.1.7. A Failure Mode and Effect Analysis (FMEA). 

4.7.1.1.1.0. Identify reliability critical items, including, but not limited to, those 
considered within the reliability and FMEA of the system. 

4.7.1.1.1.9. A fault tree analysis. 

4.7.1.1.1.10. A discussion determining effects of the reliability of the system 
components and elements resulting from storage, shelf life, packaging, transportation, 
handling and maintenance. 

4.7.1.1.1.11. Flight hardware subsystem data: 

4.7.1.1.1.11.1. A detailed description of the antenna system, including specification 
and operation manuals, as appropriate. 

4.7.1.1.1.11.2. Transponder - copies of the specification, schematics, operation 
manuals and checkout procedures. 

4.7.1.1.1.11.3. Command recei»er and decoder - copies of the specification, schematics, 
operation manuals and checkout procedures. 

4.7.1.1.1.11.4. SSA, I8U, and EBB devices - copies of the specification and operation 
manuals. This must include all electrical characteristics and shelf-life of the 
electro-explosive devices. 

4.7.1.1.1.11.5. Ordnance - a complete description of the ordnance, including its 
composition, connections, and methods of attachment. 

4.7.1.1.1.11.6. Power supply - copies of the airborne battery supply specification, 
operation manuals, and checkout procedures. 

4.7.1.1.1.11.7. Telemetry - a complete description outlining the method of compliance 
with 4.3.7 above. 

4.7.1.1.2. Ground system data test equipment requirements are: 

4.7.1.1.2.1. A complete listing and description of all test eguipcent, including 
contractor-peculiar test equipment that is utilized in checkout of the system and its 
individual components and elements. 

4.7.1.1.2.2. Copies of all specification and operation manuals for all contractor 
peculiar test equipment. 

4.7.1.1.2.3. Complete description of the design of the flight termination control 
system console (paragraph 4.3.0,31, including graphic illustrations, detailed 
schematics, functional diagrams, and proposed locations in the launch control center. 

4.7.1.2. qualification and acceptance test procedure - copies of the individual 
qualification and acceptance test plans and procedures identified during the system 
design period. 

4.7.1.3, Qualification test results - pertinent portions of the test result data may be 
extracted from the test reports and submitted in condensed form. 

4,7,1.3.1. Environmental survivability - test result data and information to show 
compliance with 4.3.1.6 above. 



4.7,1,3.3. Antenna - the antenna patterns and information according to 4.3.2. and 
4,5.1.3 above. The antenna patterns must be provided on magnetic tape and in graphical 
representation according to SAMTOR 80-1, Missile Antenna Data Requirements. 



4.7.1.3.5. SfiA, KBW, and EBW devices - test results showing the propagation of destruct 
action from the initiators to the destruct charges and requirements in 4.5.1.5 above. 

4.7.1.3.6. Ordnance - test results showing the ability of the destruct charges to 
accomplish the destruct action according to 4.5.1.6 above. 



4.7.1.4.1. System - detailed procedure for the verification check and limited 
reverifi cation check, including an outline of the launch countdown task sequence flow 
(paragraphs 4,5.2.3 and 4.5.2.3.1). 

4.7.1.4.2. Antenna system: 



4.7.1,4,2.2, Detailed procedures for the RF system sensitivity test to be performed at 
the launch vehicle assembly facility for the "factory-to-pad" concept vehicles 
14.5,2.1,1.1,3}. 



4.7.1.4.3. Coimand r 



4.7.1.4.3.2, Detailed requirements for the RF closed and open loop node test 
(paragraphs 4.5.2.1.2.3 and 4.5.2.3), 

4.7.1.4.4, SM, HBW and EBW devices - detailed procedure for the SM, HBW and E8W 
device tests (paragraphs 4.5.1.5 and 4.5.2,2), 

4.7.1.4.5, Power supply - detailed procedure for the battery test (paragraph 4.5.2.4). 

4.7.1.4.6, Ground system - detailed procedures for calibration of the control console 
(paragraph 4.3.8.3). 

- detailed procedures for installing the system and 



4.7.1.6. All preliminary system proposal data, in whole or in part* should be submitted 
to WSMC/SEO, informally, as soon as available (paragraph 4.2.1). The final (critical) 
system proposal data submission must be the foraal flight Termination System Report 
(FTSR). The FTSR should be a single volume document. Data submittal items that cannot 
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be Included in that document because of size or configuration (such as procedures, 
component operation and specification manuals, and magnetic tapes), are referenced in 
the applicable section and submitted as attachments. All data submissions in support of 
modifications or changes to either the preliminary or final proposal most be titled and 
formatted similarly to the original. The FTSH is prepared using the following format: 

4.7.1.6.1. introduction - outlines the contents of the report and includes any 
deviations to this document agreed to during the design period (paragraph 4.2.1). 

4.7.1.6.2. General system description - a brief general description and block diagram 
of the flight termination system (paragraph 4.7.1.1.1.1). 

i data specified in 4.7,1.1.1.2 and 



4.7.1.6.4. System qualification testing - system qualification test data specified in 
4.7.1.2 and 4.7.1.3 above. 

4.7.1.6.5. System recurring test procedures - system recurring test procedures 
specified in 4.7.1,4. and 4.7.1.5 above. 

4.7.1.6.6. Other torments or information - the title and information of this section is 
left to the discretion of the Range user or their contractor, but should include items 
not covered in previous sections that are pertinent to the system, launch, or complex 
being used. As an example, such infonjation normally involves data concerning the 6SE. 

4.7.2. Recurring data requirements: 

4.7.2.1. Test results - the following data, relative to the specific system for each 
individual launch, must be submitted to BSHC/SEO on a timely basis (at least 30 days 
prior to launch) to facilitate a launch ready status. 

4.7.2.1.1. Antenna data: 

4.7.2.1.1.1. Results of the VSBR and RF line insertion loss test. 

4.7.2.1.1.2. Results of the antenna and receiver system sensitivity test. 

4.7.2.1.2. CoBiand receiver and decoder: 

4.7.2.1.2.1. Results of the receiver and decoder vendor acceptance test and bench test, 
t - results of the receiver or decoder RF closed loop 

4.7.2.1.3. S8A, rW and EB» devices - results of the S8A, HBW and EBW device tests. 

4.7.2.1.4. Power supply • results of the battery activation and load test. 

4.7.2.2. Calibration results - the following data relative to calibration of the ground 
system must be provided to WSMC/SEO according to the specified calibration time schedule. 

4.7.2.2.1. Test equipment - all applicable data, such as meter correction factors and 
the electrical energy requirement for circuit breaker trip where used as the squib 
simulator impedance. 

4.7.2.2.2. Control consoles - all applicable data, such as meter calibration factors 
and the determinant value levels used in "GO" or "NO-GO" comparison circuitry. 



4.7.3, Failure report: 

4.7.3.1. Failure to meet specifications - the failure of a flight termination system or 
system component to meet WSMC approved specifications after delivery from the vendor 
must be reported in writing within 15 days of the date the failure is noted. WSMC Form 
99, Airhorne Flight Termination System Failure Report, or its equivalent is used for 
this purpose. This requirement includes failure of tests conducted at the vehicle 
contractor's plant and at WSMC. A formal report containing a description of the 
failure, an analysis of the failure, and details of corrective action taken, must be 
submitted within 60 days of the failure for approval according to 4,2,4 above, 

4.7.3.2. Failure to meet WSMC test requirements - failure of a flight termination 
system or flight termination system component to meet test procedure requirements during 
any test contained in 4.5.2 above must be reported, by telephone, to WSMC/SEO within 24 
hours of the failure. A written report containing a description and analysis of the 
failure and details of corrective action taken must be submitted for approval according 
to 4.2.4 above before that component or system will be approved for flight. 

4.7.3.3. In-flight failure - any in-flight anomaly occurring in a flight termination 
system must be reported immediately to WSMC/SEO. A detailed written report containing a 
description and analysis of the anomaly, and details of corrective action taken, must be 
submitted for approval according to 4.2.4 above before the system will be approved for 
any subsequent flights. 

4.7.4. Flight termination system modification data - modification proposals must be 
submitted for approval according to 4,2,5 above, with sufficient leadtime (a minimum of 
60 days before launch) for evaluation to avoid delay of launch schedules. The proposal 
must include all data applicable to the modification that are required in the approval 
of a new system. 

4.8, Tracking beacon and transponder systems: 

4.8.1. Discussion: 

4.8.1.1. The requirement for an in-vehicle tracking aid is stated in 1.9 above. 



4.8.2, The approval requirements detailed in 4.2 above apply to tracking beacon and 
transponder systeis. 

4.8.3, Design requirements: 
4.8.3,1. General: 

4.8.3.3.1, All missiles flown on the WTR must contain an airborne tracking system 
capable of operating within the parameters established for normal operation of the 
associated WSMC ground tracking facilities, 

4.8.3.1.2. The design, manufacture, and installation of the tracking beacon and 
transponder system must conform to the requirements contained in this chapter. 



4,8,3,1,4. All transponders launched at WSMC are double pulse interrogation coded, 
unless specifically approved as mission peculiar. 
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4.8.3.2. Environmental survivability - all components of the tracking beacon and 
transponder system, and methods of attaching or installing the system, must be designed 
and qualified to mcke sure the system has the ability to function noraally under all 
environmental conditions it wtll be subjected to (for example, extremes of altitude, 
temperature, pressure, vibrations, and acceleration). This includes the environment 
that may be experienced by the vehicle while it is within the limits of WSHC/SE 
responsibility. 

4.8.3.3. Testing survivability - all circuitry, elements, and components of the 
tracking beacon and transponder system must be capable of withstanding the repetitive 
functioning incurred during prelaunch testing without degradation, 

4.0.3.4. Antenna system - the antenna system must provide adequate coverage over 95 
percent of the radiating sphere to assure maximum interrogation and reply signal levels 
for reliable tracking along all possible flight paths within command control limits of 
HSMC responsibility. To demonstrate adequate coverage, a complete link analysis shall 
be performed. The gain margin for the link analysis must not be less than dB, The 
WSMC radar characteristics are shown in table 4-1. Further Information on the radar 
characteristics will be supplied upon request. 



Coherent 
Radars 


EIRP 

MM 


Heq. Sig Pwr. 
IdBm/aZ 


VATB 
TPQ-18 


+142.6 


-104.5 


PP 
FPQ-6 


+144.0 


-104,5 


HUGO 
fPS-16 « 


+138.7 


-97.5 


Sill 

FPS-16 #3 


+138.7 


-97.5 


HSMC* 


+131.0 


-92.5 



Tab:e 4-1, HSHC Radar Characteristics. 

4.8.3.5. Transponder - the transponder must toet any combination of the following 
requirements, simultaneously and without readjustment, under any or all required 
environmental, mechanical, and electrical flight conditions. 

n must meet requirements 
4.8.3.5,1.1. Design reliability - must meet at least a 0,995 success ratio. 



4.8.3.5.1.3. Stabilization time - as required for stabilization between transponder 
final power application and missile launch time. 



4,8,3,5,1,4. Radio Frequency Interference (RFI) requirements - MIL-STD-462, Measurement 
of Electromagnetic Interference Characteristics, and MIL-STD-461B, Electromagnetic 
Emission and Susceptibility Requirements for the Control of Electromagnetic 
Interference. 



4.8.3.5.1.6. Transponder frequency separation * fifty MHz minimum (except coherent 
transponders) transpond to interrogate frequency. 

4.8.3.5.1.7. PRE response - a 100 to 2,600 pps minimum. 

4.8.3.5.1.8. Valid interrogation response - must respond to 99 percent of valid 
interrogations above mhiinuin trigger sensitivity under all operating conditions. 

4.8.3.5.1.9. System fixed delay - must have at least one fixed delay setting of 2.5 
microseconds, plus or minus 0,2 microsecond maximum, set at a minus 55 dBm signal level. 

4.8.3.5.1.10. Power source switching - the operational performance requirements of the 
transponder must not be degraded by its internal or external power supply or switching 
between the power source. 



4.8.3.5.1.12. Fuses and circuit breakers - not. allowed. 
4.8.3.5.2. Receiver: 



4.8.3.5.2.2. Frequency variation acceptance » plus or minus 2 MHz mini™ from tuned 
center frequency with response to valid interrogation modes. 

4.8.3.5.2.3. Frequency stability - plus or minus 3 MHz maximum from tuned center 
frequency under all operating conditions and sources of drift. 

4.8.3.5.2.4. Trigger sensitivity - a -70 dBia minimum with 99 percent response and less 
tha;) 5 pps response to random noise. 

4.8.3.5.2.5. Dynamic range - zero to -65 dBm minimum with less than .03 microsecond 
delay variation (absolute}. 

i minimum with 99 percent average response 

4.8.3.5.2.7. Off-frequency rejection - eighty dB mini™ from 0.15 to 30,000 MHz, 
excluding tuning range frequencies. 

4.8.3.5.2.8. 'mage rejection - sixty dB ninimum. 

4.8.3.5.2.9. Three d3 bandwidth - eleven MHz, plus or minus three MHz iraximum. 
^8.3,5.2,10. Sixiy dB bandwidth - sixty Ml maximum. 



4,8.3.5,2,11. Pulse width acceptance - a 0.25 microsecond to 2.0 microseconds minimum 
single pulse; 0.25 micrjsecond to 1.0 microseconds minimum multiple pulse interrogatioi 
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4.8.3.5.2.12. Rise time acceptance - a 0.2 microsecond or less under all operating 
conditions. 

4.8.3.5.2.13. Fall tine acceptance - a 0.5 nicrosecond or less under all operating 
conditions. 

4.8.3.5.2.14. Interrogation nodes - single and doable pulse sininua. 

4.8.3.5.2.15. Pulse code spacing - a 3.0 to 12.0 microseconds niniutin. 

4.8.3.5.2.16. Decoder positive pulse accept limits - the interrogation pulses shall be 
accepted if the pulse spacing varies by 0.15 nicrosecond or less from the luminal 

d spacing. 



4.8.3.5.2.1?. Decoder positive pulse reject Units - the interrogation pulses shall be 
rejected if the pulse spacing varies by 0.30 nicrosecond or greater from the noiainal 
preselected spacing. 

4.0.3.5.2.18. Decoder iiiaunity - no response to single pulse interrogation under all 
coded operational conditions. 

4 3.5.2.19. CK iinunity - no response to sequenced coded (100 microseconds duration) 
and uncoded t» signal levels of zero d8n or less under all operating conditions. 

4.8.3.5.3. Transmitter: 

4.8.3.5.3.1. Tunable frequency range - a 5400 to 5900 HHz atntnm continuous range of 5 
increnental 100 HHz bands. 

4.8.3.5.3.2. Frequency stability - plus or aims 3.0 Hhz naxiiun fron assigned 
frequency after an initial wara-up period under all operating conditions. 

4.8.3.5.3.3. Frequency drift range - one HHz per tiinute naxinum under all conditions. 

4.8.3.5.3.4. Peak power output - specific power requirements are determined on 
individual program basis. 

4.8.3.5.3.5. Pulse P.F spectrum - not to exceed 3.0 divided by the pulse width in 
nicroseconds iteasured at the quarter power points. 

4.8.3.5.3.6. Pulse frequency jitter - plus or sinus 0.5 HHz aaximua pulse-to-pulse. 

4.8.3.5.3.7. Pulse characteristic - single pulse. 

4.8.3.5.3.8. Pulse width - a 0.2b to 1.0 nicroseconds except for coherent transponders. 

4.8.3.5.3.9. Pulse width jitter - a 0.06 nicrosecond niaxiwn peak-to-peak neasured at 
half power points. 

4.8.3.5.3.10. Pulse amplitude (voltage level) variation - a 1.0 dB oaxinun over 
operating PDF range. 

4.8.3.5.3.11. Pulse amplitude (voltage level) jitter - plus or ninus 0.5 dB maximum 
peak-to-peak. 

4.8.3.5.3.12. Pulse rise tine - a 0.1 nicrosecond naximun. 

4.8.3.5.3.13. Pulse fall tine - a 0.2 microsecond naximun. 



4,8,3,5,3,15, Transmitter duty cycle - a 0,0026 ninimira under .ill operating conditions. 



4,8.3,5,3.17. Transponder recovery time - fifty microseconds maximum for signal levels 
differing as much as 6£ dB. Recovers to full sensitivity with no change in reply power, 
frequency, or pulse characteristics. 

4,8,3.5.3.184 Reply lock-out protection - inhibits reply during transponder recovery 
period. 

4.8.3.5.3.10. Over-interrogation protection - restricts response to duty cycle 
limitations and recover to normal operation 500 microseconds maximum after interrogation 
PRF falls to, or below, the maximum specified value. 



4.8.3.6,2. Batteries shall be of sufficient capacity to provide adequate life for load 
and activation tests, airborne powered transponder evaluation tests, and necessary hold 
tine reserve so that at launch, sufficient battery life remains for powered flight plus 
10 percer.t of the rated battery ampere hour capacity (paragraph 4.3.6.2). 

4.8.3.7. Ground system: 

4.8.3.7.1. Test equipment: 



4,0.3.7,1.2. Range users may provide a test station to be operated by their 
contractor. If provided, the test station must have the capability of determining the 
transponder performance characteristics required by HSHC Form 89. 

4.8,3,7.2- Launch facility - the design of the RF repeater systems) used in silo type 
or inaccessible launch facilities must provide a means for direct coupling of the 
transponder test station into the RF repeater systent(s). 

4.8.3.7,3, Control console - provisions shall be made by the Range user to provide the 
following transponder controls and monitors to the launch control center Range missile 
control representative console. 

system power monitors (on-off, external-internal), 

n (on-off, external and internal 



4,8,3,7,3,3, Sensors to monitor transponder applied voltage. Voltmeters for this 
purpose are preferred; however, the option exists to provide either voltmeters or 
voltage comparator circuits with status lights. 

4.8.3*7.3.4, Ammeter to monitor quiescent and transponding mode currents. 
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4.8.3.7.3.5. Provisions for monitoring battery life or operating time. 

4.8.3.7.3.6. In addition, other monitors or controls may be required depending on the 
nature of the system and individual system components. If required, the additional 
monitors and controls are identified at the design review. 



4.8.4, The tracking beacon and transponder systems mst be, by their yery nature, of 
the highest reliability. This high reliability is ensured by placing the appropriate 
design and testing requirements on the individual components and on the system comprised 
of these components. Such reliability can be compromised if the tracking beacon and 
transponder systems components are not subject to rigorous review and control during the 
manufacturing process. 

4.8.4.1. The electronic-piece parts and materials used in the manufacture of flight 
termination system components must be of "Space Quality" as defined in HIL-STD-1547 and 
capable of meeting the general and detailed requirements set forth there. 

4.8.4.2. The manufacturers of tracking beacon and transponder systems components must 
have a quality program to make sure all machining, wiring, batching, shaping, soldering, 
basic prediction operations of any type, and processing and fabricating of any type is 
accomplished under controlled conditions. Controlled conditions include documented work 
instructions, adequate production equipment, and any special working environment. 
Documented work instructions are considered to be the criteria for much of the 
production, processing, and fabrication work. These instructions are the criteria for 

r unacceptable workmanship. 



1.5. Testing requirements: 



4.8.5.1.1. All components of the tracking beacon and transponder system, and methods of 
attaching or installing the system, must be tested to make Sure of their environmental 
survivability. 

4.8.5.1.2. Tests must be performed to determine the antenna receiving characteristics, 
to show compliance with 4.3.2 above, and provide the antenna pattern data. 

4.8.5.1.3. Transponders that have not previously been certified for use at WSMC must 
undergo qualification tests according to 4.3.2 above. Further, transponders that have 
been certified for use at WSMC with a particular vehicle mdy require additional 
qualification tests {environmental, survivability, and RFI] if the transponder is to be 
used with a different type and model launch vehicle. The qualification testing of two 
transponders may be conducted by an independent agency or by the transponder vendor. 
The identification of the test agency is determined on a case-by-case basis through 
joint WSHC and Range user agreement. In addition, certain tests are performed by the 
HSMC RF Measurements Laboratory according to a test plan developed in joint agreement 
between WSMC/SEO and the Range user. Further, the tests conducted by the WSMC RF 
Measurements Laboratory do not include any type of testing that would preclude future 
use of transponders as flight articles. The Range user is responsible for supplying two 
transponders as flight articles and two transponders for testing by the WSHC RF 
Measurements Laboratory. 

4.8.5.1.4. Power supply tests and analyses must be performed to determine battery-load 
life, considering the loads that are imposed during battery activation, load tests, 
prelaunch tests, countdown, and flight. 
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4.0.5.1.5. Retesting pay be required when modifications or changes are aade to the 
system or components. The requirement for retesti'ng will depend on the extent and type 
of modifications being made and is determined through joint wskc and Range user 
agreement on a case by case basis. 

4,0,5.2, Recurring: 

4.8.5.2.1. System - an RF open loop tracking system compatibility verification check is 
conducted as late in the launch countdown as possible. The check results are annotated 
on WSHC Form 189, Standard Tracking Transponder Evaluation/Compatibility Test. This 
check is to prove the integrity of both the airborne system and ground system. This 
verification check is conducted on airborne power and is included in the launch agency 
countdown. It is valid for a maximum of 12 hours, but must be repeated if, at any time 
after the test, the systeci is compromised (for example, disconnection of any portion of 
the system). Further, if the compatibility verification check is inconclusive, a test 
may be required using the WSHC portable radar simulator. 

4.8.5.2.2. Antenna: 

4.8.5.2.2.1. Antenna VSWR and Rf line insertion loss tests are conducted on the antenna 
systen for each missile. Any antenna system component or element change subsequent to 
the test requires retesting prior to launch. 

4.8.5.2.2.2. An RF closed loop antenna and transponder systeta RF sensitivity and 
operational characteristics test is required at WSHC if any connections in the antenna 
system, including connection to the transponder, are disconnected after completion of 
the transponder performance test, after final connection of the antenna systen to the 



4,8.5,2.3. Each transponder is performance tested, in the bench test mode, by the KSMC 
RF Measurement Laboratory or equivalent facility prior to its installation into the 
launch vehicle. The test is conducted as late in the individual iaissile systen 
receipt- thru-launch readiness sequence as possible (noraally within 90 days of launch, 
consistent with the time requirements for test result data accumulation) . The test is 
performed according to a plan developed in joint agreement between WSMC/SEO and the 
Range user. Transponder performance characteristics to he determined (in addition to 
those required by WSHC Form 89, Standard Tracking Transponder Performance Test! are 
identified in the joint WSHC and Range user test plan. The transponder must also be 
performance tested at HSHC prior to launch. The test is performed as late in the 
individual missile system receipt- thru-launch readiness sequence as possible (normally 
within 90 days of launch), consistent with the time requirements for test result data 
submission. The test is conducted in an RF closed loop system mode. The transponder 
will not be removed from the launch vehicle and instrumentation wafer or disconnected 
from the missile-borne antenna system. Testing is accomplished in an RF closed loop 
mode. In the interest of economy and testing standardization, HSHC provides a portable 
test station to be operated by HSHC RF Measurements Laboratory. However, Range users 
may provide a test station to be operated by their contractor. Specific requirements 
applicable to the RF closed loop mode performance test are: 

4.8.5.2.3.1. The HSHC RF Measurement Laboratory verifies that the test station is 
operating within the limits and specifications acceptable to WSHC/SEQ, This 
verification is performed at each six month interval according to a test plan developed 
in joint agreement between WSMC/SEO and the Range user. 

4.8.5.2.3.2, RF loss factors must be provided for the RF cable and antenna couplers, 
s performed according to a plan developed in joint agreement 



4.8.5.2.3.4. The test station must have the capability of determining the transponder 
performance characteristics required by WSMC Form 89. 

4.8.5,3, when requested by the Range user and approved by WSMC/SEG, the transponder is 
processed in the manner described in 4.5.2.1.1 above with restrictions and controls 
appropriate to this system. Justification for use of this concept, and the detailed 
procedures for implementing it, requires a joint WSMC/SEO and Range user documented 
agreement indicating joint approval. 

4.0.5.4, The battery test requirements detailed in 4.0.5.1 above apply to tracking 
beacon and transponder systems. 

4.8.5,5, The ground system test requirements detailed in 4.5.2.5 above apply to 
tracking beacon and transponder systems. 

4.8.6. A representative of WSHC/SEO will attend certain system and component level 
tracking beacon and transponder system tests and installation functions. For 
preliminary planning purposes, the general group of tests and installation functions 
that may require attendance are listed below. This listing is not all inclusive and may 
have items deleted or added, depending on the type and nature of missile system launch 
facility, and tracking beacon and transponder system. For complete clarification, the 
firm retirements applicable to each missile system program shall be specified by 
separate correspondence to each Range user. 

4.8.6.1. Transponder performance test conducted at WSMC, 

4.8.6.2. Antenna system VSHR and RF insertion loss test (if conducted at WSMC). 



4.8.6.4. Battery load and activation test. 

4.8.6.5. Tracking beacon and transponder system installation inspection. 

4.8.6.6. Tracking beacon and transponder system associated ground systen test. 

4.8.6.7. Preliminary tracking beacon and transponder system RF open loop compatibility 
verification check. This is not a WSHC/SEO required test. However, the range user 
normally conducts several of this type check during the missile receipt-thru-launch 
process for the purpose of detecting and resolving any problem areas prior to the launch 
countdown test. 

4.8.6.8. Launch countdown tracking beacon and transponder system RF open loop 
compatibility verification check. 

4.8.7. Data requirements: 

4.8.7.1. Initial - the following data must be submitted in support of a tracking beacon 
and transponder system proposal. All schematics, functional diagrams, and operational 
manuals must have well defined, or standard IEEE, or MIL-SPEC terminology and symbols. 

4.8.7.1,1. Design: 

4.8.7.1.1,1. System: 

4,8,7,1,1.1.1. A block diagram of the entire system with reference to the location in 
the vehicle of each component and element. 



.8.7.1.1.1.2. Detailed schematics and functional diagrams of the system, including all 
power sources, relays, switching devices, connectors, and pin nrnhers showing 
manufacturer specifications and tolerances. 

.1.1.3. Detailed functional description of the operation of each exponent and 



3.7.1.1.2. Antenna - a detailed description of the antenna system with the 
specification and operation manuals, as appropriate. 

8.7.1.1.3. Transponder - copies of the specification and operation manuals. 



8.7.1.1.5. Ground system: 

8.7.1.1.5.1. Launch facility - a description of the Rf repeater system. 

7.1,1.5.2. Test equipment: 

8.7,1,1,5.2.1. A complete listing and description of all test equipment, including 
contractor-peculiar test equipment used to checkout the system and its individual 
components and elements. 

7.1.1.5.2,2. Copies of all specification and operation manuals for all 
contractor-peculiar test equipment used to checkout the system and its individual 
components and elements. 

8.7.1.1.5.3, Control console - a complete description of the operation of the 
tracking beacon and transponder system controls and monitors. 

1.7.1.2. Qualification test procedure - copies of the qualification test plans and 
procedures required for submission to HSHC, identified by the KSHC/SEO representative 
during the system design period. 

8.7.1.3. Salification test results - pertinent portions of the test result data may 
be extracted from the test reports and submitted in a condensed form. 



1.7.1.3.2. Antenna - the antenna patterns and information according to the 
rettirirenents of 4.8,5,1.2 above. The antenna patterns must be provided both on magnetic 
tape and in graphical representation. 

1.7.1.3.3. Transponder - the results of qualification tests, 4.8.5.1.3 above. 



8.7, 1,3.4. Power supply - battery load test analysis, 4.8.5,1.4 above, to show 
compliance with 4.8.3.6.2 above. 

8.7.1.4, Recurring test procedure: 



7.1.4.1. The procedure for the system compatibility verification check, 4.8.5.2.1 
above. This procedure is limited to the steps involved with controlling and mom'toring 
the airborne system 4,0.3.7.3 above. Standard WSHC Radar Compatibility Test Operational 
Procedure No. 0-0230175A007 is utilized by the radar system. 
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4.8.7.1,4,2, Antenna: 



4,8.7.1.4.2.2. Detailed procedure for the antenna and transponder system sensitivity 
and operational characteristics test, 4,8,5,2,2,2 above. 



4,8,7.1.4.3. Transponder: 



4.8.7.1.4.3.2. Detailed procedure for the RF closed loop mode performance test if the 
test is to be performed by the Range user, or the contractor, 4.8.5.2.3.1 and 4.8.5.3 
above. 



4.8.7.1.4.5. Ground system; 

4.8.7.1.4.5.1. Test equipment - detailed procedure for calibration of test equipment 
{paragraph 4.5.2.5.3}. 

4.8.7.1.4.5.2. Control console - detailed procedure for calibration of the console 
(paragraph 4.5.2.5.11. 

4.8.7.1.5. All preliminary systen proposal data, in whole or in part, should be 
submitted to KSfC/ScG, infernally, as soon as available. The final (critical) system 
proposal data submission must be a formal report included as a portion of the FTSfi 
(paragraph 4.7.1.6). Ideally, the tracking beacon and transponder system data should be 
provided as a volume of the FTSR, separate from the v&lime containing the data on that 
portion of the flight termination control system that provides for termination of 
missile flight. 3ata submittal items that cannot be included in that document, because 
of size or configuration (such as procedures, component operation and specification 
manual?) and magnetic tapes), are referenced and submitted as an attachment. All data 
submission in support of modification or changes to either the preliminary or final 
proposal must he titled and formatted similarly to the original. The document is 
prepared using the following format: 

4.8.7.1.5.1. Introduction - outlines the contents of the report and also includes any 
deviation to the docutwnt agreed to during the design period (paragraph 4.2.1). 

4.8.7.1.5.2. General system description - a brief general description and block diagram 
of the tracking beacon and transponder system, 4,8.7.1.1.1.1 above. 



4.3.7.1.5.5, System recurring test procedures - system recurring test procedures 
specified in 4,8.7.1,4.1 thru 4.8.7.1.4.5 above. 



items not covered in previous sections that are pertinent to the system, launch, or 
complex being used. As an example, such information normally involves data concernin 
the ground support equipment. 



4.8.7.2,1. Test result - the following data, relative to the specific system for each 
individual launch, must he submitted to WSE/SEO on a timely basis to facilitate a 
launch ready status. 

4.8.7.2.1.1. Antenna: 

4.8.7.2.1.1.1. Results of the VSWR and HF line insertion loss tests, 4.8.5.2.2.1 above. 



4.8.7.2.1.2. Transponder: 

4.8.7.2.1.2.1. Results of the transponder vendor acceptance test. 

4.2. 7.2.1. 2.2. Results of the transponder bench test node performance test, 4,8.5.2.3 



4.8.7.2.1.2.3. Results of the transponder RF closed loop node performance test, if 
conducted by the Range user or the contractor, 4.8.5.2.3.1.2 above. Results of this 
test must be annotated on HSHC hm 89. Transponder performance characteristic data 
from this test are distributed to the HSHC tracking radars. To permit a timely 
dissemination of this date, HSHC Form 89 should be provided to HSfiC/SFO no later than 18 
working days prior to the forecast launch date. 

4.8.7.2,1.3. Power supply - ^sults of th« battery load and activation test, 4.8.5,1.4 



4.8.7.2.1.4. Ground system - data relative to calibration of the ground system must be 
provided to HSHC/SEO according to the specified calibration time schedule. 

4.8.7.2.1.5. Components or system failure - the requirement for reporting failure of a 
component or system to meet the requirements of a specific test applies to tracking 
beacon and transponder system. 

4.9. Telemetry systems: 

4.9.1. Telemetered data, particularly data concerning the status of the flight 
termination system components and of missile and launch vehicle performance, form an 
integral part of the missile flight control system. Because of this, certain components 
of the telemetry system are considered to be an integral part of the flight termination 
control system. As such, these components and subsystems are subject to the same level 
Of scrutiny as other portions of the system. The determination of which portions of the 
telemetry system trill be subject to this scrutiny is made on a program- by-program basis 
as early in the program as is feasible. Also at this time, the specifics of this 
scrutiny are detailed, including data requirements, participation during the design 
period, test requirements, and test attendance. 

4.10. Additional information - detailed data in the operational parameters of 
instrumentation facilities to be employed by HSHC In support of a particular program are 
available from USHC, Other sources of information that may be useful in preparing data 
required by this section are listed in attachment 2. 



SPACE AND MISSILE SYSTEMS GROUND OPERATIONS 

5.1. Space and Missile Systems Ground Operations Introduction. This chapter presents 
HSHC/SE requirements that apply to all space and missile systems ground operations 
conducted under WSMC jurisdiction at Vandenberg AFB. 

5.2. Safety Responsibilities: 

5.2.1. WSHC/SE is responsible for developing and managing the Commander's Safety 
Program (paragraph 1.3). WSMC/SEM provides launch complex safety management, performs 
safety surveillance and support of hazardous and dangerous operations (certain areas 
covered by APR 207-24, (S) System Security Standard - Space Launch Complexes (II) are 
excepted}, and assists the 6595th Group Commanders and their respective command elements 
In identifying and resolving space and missile safety problems. The 6595th Group 
Commanders (6595 ATG, HTfi, STG) are responsible for the implementation of space and 
missile systems ground safety programs during all prelaunch, launch, and recovery or 
landing operations. 

5.2.2. A safety hold is a directive (usually verbal) to either prevent an operation 
from starting (NO-GO) or stopping an operation that is already underway. Typical 
reasons for a safety hold are; 

5.2.2.1. Safety criteria cannot be assured or maintained. 

5.2.2.2. Safety criteria is being violated. 

5.2.2.3. Personnel or equipment is, or will be, unduly jeopardized. 

5.2.3. Persons authorized to call a safety hold are: 

5.2.3.1. The person in charge of an operation (launch control officer (LCD!, task 
supervisor, or test conductor) is authorized and required to place an operation in a 
safety hold if safety criteria are being violated or personnel and equipment are being 
unduly jeopardized. Operations placed in a safety hold must not be resumed until the 
discrepancy has been corrected. 

5.2.3.2. The Complex Safety Officer [CSO), or, in his absence, the LCO, provides 
authoritative safety surveillance of hazardous operations and aids in resolving safety 
problems. When, in the judgment of the CSO, an operation being monitored is dangerous 
to life or property, the CSO advises the LCO, task supervisor, test conductor, or other 
person in command of the operation, and imposes the requirement for a safety hold or 
"NO-GO." The person in command of the operation will give the command to cease the 
operation at the first safe point in consonance with the technical data governing the 
operation. If time does not permit communication with the task supervisor, the CSO 
transmits the hold directly to the person performing the task. 

5.2.3.3. When a person in command (launch controller, task supervisor, etc.) is not 
immediately available, the CSO or Complex Safety Technician (CST) issues an immediate 
safety hold order to stop an unsafe operation. The operation must not be resumed until 
the discrepancy is resolved. 

5.2.3.4. Personnel not specifically designated as task supervisors or qualified as CSOs 
and CSTs, who observe any of the above conditions that would warrant a safety hold 



decision, are responsible for bringing such conditions to the immediate attention of the 
responsible task supervisor and taking whatever immediate action is warranted to 
safeguard life and property. 

NOTE: When an unsafe condition is noted and a safety hold is declared, the operation 
ceases at the first safe hold point in consonance with the technical data governing the 
operation. The person calling the hold immediately notifies all agencies it may affect. 

5,3, Launch Complex Safety Plan (LCSP). The LCSP is required for each launch complex 
or major system complex such as Titan, Hinuteman, Atlas, Peacekeeper, and Space 
Transportation Systems. The appropriate group commander is responsible for making sure 
the LCSP is published and kept current. If appropriate, it also covers associated 
support facilities elsewhere on base. It is a comprehensive document intended to 
clarify or detail existing broad safety rules and to provide needed rules, not published 
elsewhere, for all personnel at the facility. The LCSP shall be approved by WSMC/SI and 
must, as a minimum, include: 



5.3.2. A list of all hazards present at the facility and any special rules or 
precautions required for each. 

5.3.3. Detailed procedures for implementing the requirements for initial safety 
training of personnel, annual recurring training, and documentation. Include such 
subjects as hazard recognition, buddy system requirements, checklists, safety equipment, 
monitoring and warning devices, and emergency evacuation procedures. 

5.3.4. ft program to ensure that appropriate personnel are trained in the approved 
methods of cardiopulmonary resuscitation and first-aid procedures, and that required 
documentation is recorded (paragraph 5,6,6.7), 

5.3.5. Visitor safety briefings, when required, and who will present them, 

5.3.6. Complete explanation of all aural-visual hazard warning systems, their 
operation, and response requirements. 



5.3.8. Mishap reporting and emergency response phone numbers. Include irradiate 
notification to the C$0 and CST of any equipment and properly damage or personnel injury. 

5.3.9. Self- inspect ion program. 

5.3.10. Any safety checklists not otherwise provided in individual test and operations 
procedures. 

5.3.11. Ground processing by Range users must be performed only by persons certified in 
the disciplines required for those processes. Range users provide a description of 
their certification and training program in the facility and complex safety plan. The 
description specifies the personnel training required and the certification procedures 
employed to establish acceptable skill levels for those involved in hazardous and 
dangerous operations. 

5.3.12. A list and description of approved protective clothing, breathing apparatus, 
and associated personal protective devices and their required use. Specifically include 
hard hats, areas of use or wear, and approved types and color coding. 
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5.3.13. Detailed procedures for reaction to electrical storm warnings, high winds, etc. 



5.3.15. Amplification of "No Smoking" rules for high hazard areas such as propellent or 
explosive locations, posting of warning signs, and positive rules requiring that matches 
and lighters be left outside the areas. Eating and drinking is prohibited in areas 
where toxic or nuclear materials are being handled or processed. 

5.3.16. General locations of fire alarm boxes, installed fire suppressant systems, and 
appropriate information regarding use. 

5.3.17. Location of emergency rescue equipment, medical and first-aid rooms. 

5,3.10, A description of potential hazards to the facilities and personnel that are not 
a part of the facility or systems (such as moior vehicles or equipment with internal 
combustion engines). 

5.3.19. A safety badge (permit) system detailing temporary, visitor, permanent, and 
indefinite requirements (approved by HSfiC/SE), shall be established for each missile 
system or complex. Procedures identifying detailed requirements for each type of badge 
or permit are included. (WSfiC/SE retains the option to train and certify Safety and 
other WSHC personnel, as required, on each missile system or complex.) Range users will 
furnish WSHC/SE updated listings of permit numbers, names, and assigned agencies prior 
to all launches. 

5.3.20. Use of vehicles: 

5.3.20.1. Vehicles must not be parked within 25 feet of propellant lines containing 
propellants. Vehicles may proceed within the 25-foot limit when required to deliver 
heavy equipment. After offloading, the vehicle shall be removed. 

5.3.20.2. Vehicles must not be parked within 50 feet of propellant storage tanks 
containing propellants. Vehicles may proceed within the 50-foot limit to deliver heavy 
equipment, or tractors may deliver or pick-up tankers and servicing units. After 
offloading of equipment, vehicles shall be removed. Tractors remaining with tankers 
must follow the requirements of the loading and offloading Hazardous Operating Procedure 



5.3.20.3, Motor vehicles or equipment employing internal combustion engines equipped 
with or without catalytic converters, require spark arrestors and carburetor flame 
arrestors when: 

5*3.20.3.1. Transporting explosives that have exposed grain, scrap, waste, or items 
visibly contaminated with explosives. 

5.3.20.3.2. Operating internal combustion engines within the control area during 
propellant transfer. 

5.3.20.4, Mobile radio transmitters Must not be operated within 25 feet of ordnance or 
{unless intrinsically safe! within 50 feet of fueling operations. 

5.4. Hazardous and Dangerous Operations. These operations have systems with high 
energy potentials or toxic properties requiring special measures be taken to limit risk 
to personnel or property. Work involving ordnance materials, missile fuels and 
oxidizers, cryogenics, high pressures, lasers, high energy RF emissions, and radioactive 
components are examples. Specific actions are required for all hazardous and dangerous 



operations involving, as a minimum, activation of a safety control area, display of 
amber or red warning lights, and use of an approved procedure or checklist. The latter 
requirements are fulfilled by the inclusion of special safety procedures in the approved 
written document for the work involved. 

NOTE: Pad status lights, amber and red, are used only during the time hazardous 
operations are in progress and will not be used to identify loaded tanks, missiles, or 
facilities when in a static mode. Exceptions require specific WSMC/SE approval. 

5.4.1. For hazardous-dangerous operations safety support, the Range user will notify 
WSMC/SE of the time and nature of all hazardous and dangerous operations through normal 
scheduling channels, WSMC/SE personnel will not be denied access to any area where such 
operations are conducted. WSKC complex safety representatives provide mandatory safety 
support and surveillance of certain operations, so identified by WSMC/SE, and 
periodically check all other hazardous operations to evaluate safety compliance by the 
user. The presence of WSMC/SE representatives is required for all launch operations, 
most dangerous operations, and selected hazardous operations. When safety support is 
listed as mandatory, the operations will not be started until the required support is 
present- 

5.4.2. Operations identified as hazardous or dangerous must be scheduled to ensure that 
WSMC/SE and Base agencies such as Fire Department and Security Police are notified. 
Scheduling is done by utilizing the 1 STRAP Form 36, Missile Operations Support 
Requirements, {MOSR}, according to 1 STRAE3R 80-1, ICBH Operational Test and Evaluation 
(FOUO), and 1 STRADR 127-200. Safety, fire, security, and medical personnel and 
equipment determined necessary must be approved by WSMC/SE prior to final coordination 
of MOSR requests, 

5.4.3. All hazardous and dangerous operations, including launches conducted at WSHC and 
associated with missile and space vehicle operations and their support, shall be covered 
by WSHC/SF approved operating procedures. Special test operation procedures that may 
not meet the criteria for hazardous or dangerous operations, but have a safety 
required for protective clothing, safety equipment, or safety control areas will be 
approved by WSMC/SE. Procedures and countdown manuals are developed by the agency 
responsible for performing the work. The user is responsible for submitting these 
procedures, in duplicate, to WSMC/SE for review and approval 30 days prior to the need 
date. The user reviews and approves the procedures prior to splitting them to 
WSMC/SE. All signature blocks are signed prior to submittal of the procedure or 
countdown manuals. Draft or preliminary copies may be sent to WSMC/SE for preliminary 
comments without previous review or approval of the user. This technique of 
simultaneous review is encouraged. Changes to approved or redlined procedures must meet 
all requirements of new procedures. (Exception: Redline changes to procedures in 
progress shall be approved by the CSO on site.} 

approved HOP is not allowed without the specific approval of 



5.4.3.2. Hazardous operating procedures shall be written in the clearest, most logical, 
and precise tens to make sure personnel concerned with performing the task understand 
the steps to be performed. Sequential, step-by-step directions are written in clear 
language and with sufficient detail to allow a qualified technician, mechanic, or 
operator to follow them easily. Emergency shutdown or backout procedures are normally 
included but may not be required if adequately provided for in the complex safety plan. 
Excessive use of second tier reference to other directives is not acceptable. 

icluded in all HOPS (the format, however, 
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5.4.3.3.3. Each hazardous step or instruction is immediately prefaced in bold type with 
the attention word "WARNING," "CAUTION," OR "fiGIE," according to the following criteria: 

5.4.3.3.3.1. WARNING - operating procedure that must be strictly complied with or 
personnel injury or loss of life may result. 

5.4.3.3.3.2. CAUTION - operating procedure that must be strictly complied with or 
equipment damage may result. 

5.4.3.3.3.3. NOTE - operating procedure of such importance that it must be emphasized. 

5.4.3.3.4. Specific warnings, cautions, or notes appear immediately preceding the 
hazardous step. Identify the end of the hazardous stepfsh General caution and warning 
note prerequisites should be included in the preface. In addition, the hazardous 
configuration of the vehicle, system, and subsystem prior to the start, and after 
completion, of tte operation should he defined. 

5.4.3.3.5. A list of tools, personal protective safety equipment, and other test 
support equipment for the job and, where required, HSMC/SE approved equipment such as 
Alinco Meters. Specify required monitoring devices= 

5.4.3.3.6. Appropriate safety highlights such as evacuation, safety clearance to 
proceed, etc., must be detailed in the proper place in the procedure. 

5.4.3.3.7. A list of essential personnel , by job title {funceion and number), is 
required for all hazardous and dangerou> operations. HSHC Form 33, Safety Access List, 
will be completed for all safety control areas esiablished by HSMC/SE whenever approved 
contractor access lists are not available and provided to SE. 

5.5. Complex Safety Officer's Console: 

5.5.1. Sufficient space must be provided in an appropriate location to install and 
operate a pad safety console in each launch control center, block house, firing room, 
and other similar facilities. The console will be provided by the range user. WSfC/SE 
will approve the design of the console. Minimum requirements for the console must 
incorporate: 

5.5.1.1. Countdown nets capable of monitoring and transmitting. 

5.5.1.2. Direct line(s) to the test conductor and LCD. 

5.5.1.3. A direct line to the MFCO. 

5.5.1.4. Direct lines to the Launch Support Team Chief end fallback area. 

5.5.1.5. Direct lines to primary access control point for safety control areas. 

5.5.1.6. Direct lines to facility safety net. 

5.5.1.7. Access to the facility PA systems with emergency override capability. 
5,5.1.0. At least, one class A dial line. 
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5.5.1.9. A direct line to the Range Control Officer (RCO). 

5.5.1.10. Direct line to hospital emergency room. 

5.5.1.11. RF nets, as required, by specific MSGSA- 

5.5.2. Console shail be located with clear view of appropriate blockhouse and control 
center TV monitors, with control of one or more TV cameras for primary safety use. 

5.5.3. Controls one or more TV monitors to enable CSO surveillance of specific areas. 
(To be defined in individual system MSGSA.) Video taping of specific hazardous 
operations will be coordinated, as required, with the launch controller or test 
conductor prior to the start of the operation. 

5.5.4. Controls for facility aural and visual warning system, that is, switch 
Selection of Green, Amber, and Red warning lights with separate control of klaxon or 
siren, 

5.5.5. Wind speed and direction readouts, 

5.5.6. Complex and Range clearance lights to tFCQ. 

5.5.7. The ranee user will provide the capability for communication and video recording 
and playback of hazardous operations as designated by the CSO. Designated recordings 
will remain on file for 180 days, 

5.6. General Operating Rules and Requirements: 

5.6,1. General safety requirements cited in this section shall be included in all 
applicable hazardous procedures or operations safety checklists. 

5.6.1.1. Verify that all installed and portable required safety systems and equipment 
are operational before operations are permitted to begin. 

5.6.1.2. Any operation involving propel lant transfer or ordnance activities must not 
begin when an electrical storm is imminent. Such operations shall be interrupted or 
expeditiously concluded if an electrical storm approaches within a 10-mile radius. 

5.6.1.3. Delays or lengthy interruptions during hazardous operations are not conducive 
to good safety practices. Test conductors or task supervisors should consider 
rescheduling the operation or establishing safety hold points to determine personnel 
fatigue and expiration of crew time prior to continuing. Personnel participating in 
fissile operations are normally scheduled to work only eight hours commencing when the 
individual reports for duty. When justified by mission requirements, the duty hours may 
be extended to 12 hours. If a need exists to exceed the 12-hour limit, the applicable 
unit test conductor or task supervisor, after a complete evaluation of the hazards and 
risks involved in continuing the task, is authorized to extend total crew time, not to 
exceed 34 hours, after coordination and approval of WSMC/SE, In no circumstance should 
a task or operation be started that will exceed the 12 hour crew time restriction. Any 
delay interrupting ordnance or propellartt operations must be coordinated with WSKC/SE. 

5.6.1.4. Normally, simultaneous hazardous operations conducted in adjacent areas will 
not be approved ("adjacent" means side by side, in the same complex or building, or in 
close enough proximity to affect the other hazardous operations). When it is necessary 
to schedule simultaneous hazardous operations in order to meet a critical program 
milestone, approval must be obtained from W5MC/SE on an individual basis. 
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5.6.1.5, nonessential personnel must leave the hazardous area any time a safety control 
area is in effect. Visitor requests into the safety control area must be coordinated 

with wshc/se (cso/crn. 

5.6.1.6. Essential personnel my continue working within the safety control zone during 
a hazardous operation, but must evacuate the safety control zone during a dangerous 
operation. Hazardous and dangerous operations must be identified in the appropriate 
procedure. 

5.6,2. Propellent systems: 

5.6.2.1. Persona] protective equipment for operations involving propellants are listed 
in AFH 161-30, volumes I and II, and AFOSH standards. Protective equipment or clothing 
must be approved by WSHC/SE prior to use. 

5.6.2.2. Written procedures for propellant operations must clearly specify those tises 
and circumstances when personal protective clothing and breathing equipment must be 
worn, carried, or positioned within arm's reach. 

5.6.2.3. When work is to be performed in a known, or suspected, oxygen deficient or 
contaminated environment, self-contained and supplied air breathing equipment must be 
worn. Atmospheric or gas detection and measurement devices shall be used to determine 
atmosphere content before entry. (A suspect environment may result from other 
circumstances than toxic fuel involvement, such as gaseous nitrogen, fire, etc.} 

5.6.2.4. When establishing initial leak free flow of toxic propel 1 ants during ready 
storage vessels (RSV) onload and offload from tanker trucks and during propellant 
transfer, personnel directly involved in the operation must be fully dressed in approved 
protective clothing such as SCAPE. RFHCO, or SPLASH, and have appropriate breathing 
apparatus readily available for immediate use, or worn as the written procedures for the 
particular task may require. 

5.6.2.5. Propellant systara components such as valves, regulators, orifices, flowmeters, 
etc., inherently entrap propellents to some degree. Disassembly of these components can 
cause serious injury to personnel not made aware of the possible presence of dangerous 
propellents. Tagging of removed or disassembled components contaminated by propellants 
and their transportation will be according to TO 00-25-223 and applicable AFOSH 
directives. 

5.6.2.6. HOPs covering hypergolic propellant transfer and handling will reflect the 
necessity for preventing the fuel and oxidizer, in liquid or vaporous states, from 
coding in contact with each other. 

5.6.2.7. Simultaneous tanking of fuels and oxidizers aboard a missile is permitted only 
on systems that are remotely controlled and when all personnel are clear of the danger 
area. Each system is independently leak-checked prior to propellant flow. Simultaneous 
tanking must be approved by HSHC/SE. 

5,6.2.0. Tanking of toxic or cryogenic liquids aboard a sissile is performed as late in 
the countdown as practical. Reentry into the area that has a missile with fuel and 
oxidizer aboard must be held to a minimum and subject to HSHC/SE approval. 

5.6,2,9. Minor leaks or spills are those that only affect the immediate working area, 
present little or no hazard to personnel, and do not involve damage to facilities^ 
equipment. These are washed and flushed with water into collecting tanks or holding 
basins if necessary. The propellant oirt not be flashed to surrounding ground surface 
if ecological or health hazards are involved. Disposal procedures for the latter must 
be approved by the Bioenvirowiental Engineering Services at VAFB. 
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5.6.2.10. Major spills and leaks are those that could affect regions beyond the 
immediate work area, constitute a significant hazard to personnel in the adjacent work 
areas or distant downwind areas, or involve damage to facilities or equipment. Written 
propellant handling procedures or plans must at least provide for: 

5.6.2.10.1. Shutting off the source of the propellant. 

5.6.2*10.2. Rescue of injured or trapped personnel. 

5.6.2.10.3. Notifying emergency reaction agencies such as fire department, complex 
safety, hospital, security police, and bioenvironnsental services, 

5.6.2.10.4. 1 raned iately notifying all areas, nearby and distant, where people are 
present and may he subject to exposure of toxic material. This normally means all 
locations in the predicted THC for the subject area. 

5.6.2.10.5. Evacuation of the area. 

5.6.2.11. Spills of cryogenic liquids must he flushed with large amounts of water, as 
appropriate, into the surrounding ground surface or a holding basin. Spills of toxic or 
corrosive propellants, or those that could affect the public health or ecology, are 
normally flushed with water, or another neutralizing agent, into a collecting tank to be 
disposed of by approved procedures. 

5.6.2.12. Written procedures must include immediate emergency action, such as: skin or 
eye contact with toxic propellants must bt flushed with copious amounts of water for a 
minimum of 15 minutes. Exposed persons are taken to the nearest iiiedical facility 
immediately after the minimum water flushing treatment has been given, unless a 
qualified medical technician or doctor directs other action. 

5.6.2.13. HOPs will reflect meteorological limitations for use by all agencies in 
scheduling and conducting toxic propellant operations such as loading, sampling, 
conditioning, etc. Precautions shall be taken to protect all personnel and property 
from atmospheric concentrations of toxic materials that exceed the threshold limit 
value. The supervisor responsible for the transfer and handling operation is 
responsible for obtaining the predicted THC and determining that conditions meet the 
limitations shown in the HOP approved by (SKC/SE. Venting of toxic vapors requires 
HSHC/SE approval. 

5.6.2.14. HOPs for handling of toxic propellants and materials must include as a 



5.6.2.14.1. Type, location, and use of monitoring devices. 

5.6.2.14.2. Type, pake, and location of breathing apparatus, protective clothing, and 
special handling equipment. 



5.6.2.14.4. Specific THC required for each propellant task or 

5.6.3, For photographic operational constraints, the use of photographic lighting 
equipment (flashbulbs, strobe lights, photofloods) is prohibited within 100 feet of the 
missile whenever the missile is fueled, and within 100 feet of a propellant storage 
tank; also, within 10 feet of exposed solid propellants and ordnance, or other explosive 



hazardous environments. Any exception to these restrictions requires approval by 
HSMC/SE on an individual basis depending on the type of photographic equipment to be 
used and the nature of the subject to be photographed. 

5.6.4. All ordnance items used at WSflC will be handled according to the procedures 
contained in AFR 127-100, AfOSH standards, VAFBR 136-1, Storage, Handling, and 
Inspection of Contractor and Tenant Explosives on VAFB, 1 STRADR 127-200, and 
appropriate technical orders. HOPs must include specific safety precautions and 
information such as grounding requirements, essential personnel, required tools, and 
electrical checkout equipment. Protective equipment for ordnance operations must be 
approved by WSHC/SE prior to use. 

5.6.4.1. Category A ordnance installation or removal and electrical connection or 
disconnection will be designated as hazardous operations. 

5.6.4.2. Established written procedures shall include any necessary precautions for 
protection of ordnance items against inadvertent activation caused by RF energy- This 
includes provisions to make sure any transmitters within hazardous range do not radiate 
during the ordnance operation, 

5.6.4.3. Written procedures must specify that all ordnance circuit control switches and 
firing line interrupt switches should be in the off position for electrical connection 
of ordnance and must remain off except when otherwise provided in approved procedures. 

5.6.4.4. Leg or wrist stats must be used by personnel handling ordnance with shorting 
caps removed (during connect or disconnect). The objective is to provide a positive 
bond between person, ordnance itesi, and facility ground. When conductive floors and 
shoes are to be used in lieu of wrist stats, written application must be made to WSMC/SE 
for deviation from this requirement and special provisions must be followed* 

5.6.4.5. When approved, conductive floors, grounding mats, or grounding terminals must 
have the same potential as the system employing the EED. This is accomplished by the 
use of an electrical bond. 

5.6.4.6. When hoisting ordnance with a crane, the methods of paragraph 3.14.7.1 will be 
utilized. 

5.6.4.7. During any operation involving exposed solid propellant grains, leg or wrist 
stats are mandatory. Leg or wrist stats should be designed so the wire strap can be 
disconnected easily from both the wrist or leg strap and the grounding terminal. A 
method for continuity checks must be available. 

5.6.4.0, Preinstallation electrical checkouts of any ordnance items will be performed 
in facilities or test cells approved by HSfiC/SE. 

5.6.4.9. toiitmand destmct receivers will only be turned on during scheduled operations 
with approved procedures, after ordnance of the flight termination system has been 
electrically connected. 

5.6.5. For pressure systems, safe operating procedures will be prepared governing the 
operation, testing, maintenance, and installation by the agency performing the specific 
task. The criteria contained in AFR 127-101, Ground Accident Prevention Handbook, AFOStf 
standards, TO 00-25-223, and 1 STRADR 127-cQO will be used in the design and testing and 
in developing safety operating procedures. 
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5.6.5.1. Each complete system must be pressure tested and leak-checked at its -naximum 
operating pressure at least once and pressure relief valves operationally tested at 10 
percent above the maximum operating pressure prior to use in normal operations at WSMC. 
The same requirements apply for modified orrepaired components. 

5.6.5.2. Hew, modified, or repaired system and subsystems must be functionally 
validated prior to acceptance for normal operational use. The user will certify that 
validation tests were successfully completed and the system and subsystem are certified 



5.6.5.3. Functional tests up to maximum operating pressure are required each time a 
component, such as a valve or regulator, is disassembled for repair, modification, or 
replacement of soft goods (valve seats) and reassembled for use. 

5.6.5.4. Operating procedures involving high pressure must include: 

5.6.5.4.1. Posting of warning signs with hazards identified. 

5.6.5.4.2. Establishing safety control areas. 

5.6.5.4.3. Inspecting system before pressurizing. 

5.6.5.4.4. Personal protection equipment requirements. 

5.6.5.5. Personnel present during pressurization must be limited to those in direct 
support of the operation or in a training status. 

5.6.5.6. All personnel shall be evacuated whenever pressure exceeds the maximimi 
allowable working pressure or SO percent of the design burst pressure, whichever is 
lower. 

5.6.5.7. Only essential personnel shall be exposed to pressures between 25 and 50 
percent of the design burst pressure of a system, 

5.6.6. Electrical systems : 

5.6.6.1. Electrical and static ground points are tested and checked periodically 
according to AFR 127-100, AFR 127-101, Ground Accident Prevention Handbook, and AF0SH 
standards, or HSKC/SE determines the requirements if specific criteria is not available, 

5.6.6.2. Electromagnetic impulse (EMI) testing is not conducted with live EEOs 
installed without approval of WSMC/SE. 

5.6.6.3. Hazardous operating procedures shall be written to cover hazardous electrical 
tasks, W5MC requires that AF Pamphlet 85-1, Electrical Facilities Safe Practices 
Handbook, TO 00-25-232, and the National Electrical Code be followed, as applicable, 
HOPs must address as a minimum: 

5.6.6.3.1. Tagging and lockout control switches. 

5.6.6.3.2. Use of approved nonconductive mechanical fuse pullers. 

5.6.6.3.3. Provision and use of personal protective clothing and equipment. 

5.6.6.3.4. Grounding of equipment and personnel. 

5.6.6.3.5. Use of "Buddy System" (mandatory on energized equipment and circuits). 



5.6.6.3.6. Safety procedures to be followed when working on energized equipment and 
circuits. 

5.6.6.3.7. Fire protection and equipment, 

5.6.6.3.8. Knowledge of resuscitation procedures. 

5.6.6.4, Special protective equipment must be rcade available for all operations 
associated with electrical hazards as specified in directives listed in 5,6,6.3 above. 
This equipment is inspected periodically and maintained in serviceable condition. 

5.6.6.5, Whenever work is performed on energized electrical equipment or circuits, 
there must be a minimum of two people present (Buddy System}. 

5.6.6.6, Personnel working on hazardous circuits must not wear loose clothing, rings, 
watches, or other metallic objects that can act as conductors of electricity. 

5.6.6.7, It is essential that all personnel who perform maintenance or repair of 
electrical systems be trained in approved cardiopulmonary resuscitation (CPR) methods, 

5.6.7. Radio frequency and rii crowave systems - operations involving RF radiation shall 
be conducted according to procedures approved by the USftF Hospital Bioenvironaental 
Engineering Services. Copies of al! personnel hazard data for electromagnetic radiation 
(for example, measurements, sitings, areas posted, etc.) are required by 
Bioenvironiiiental Health Services as specified in AFOSH 161-9. 

5.6.7.1. Access to areas where radiation PELs exceed those stated in AFOSH 161-9 will 
be controlled. The appropriate power meters and antennas specified in TO 31A-1G-4 and 
AFOSH 161-9 are used for making these power density measurements. Personnel are 
prohibited from performing work in antenna, waveguide, or feeder horn structures while 
the equipment is energized if exposure to any part of the body could exceed those 
levels. For higher levels, specific approval must be obtained from the USAF Hospital, 
Bioenviromental Engineering Services, which will make appropriate calculations 
according to AFOSH 161-9 for time weighted exposures. 

5.6.7.2. Care is exercised by all concerned to rake sure that personnel are not allowed 
in the calculated or surveyed energy ranges of operating generators that exceed PELs. 
Procedures are established to exclud? personnel from entering these designated 
controlled areas while equipment is energized. AF Fora 737, Warning RF Radiation Hazard, 
is posted to warn personnel of RF hazards. X-ray radiation hazard areas within RF 
generating circuitry are marked with the radiation symbol, and the roentgen output per 
hour is recorded. 

5.6.7.3. The use of RF personal protective suits in areas containing RF radiation in 
excess of the applicable PELs is not generally considered appropriate and will not be 
done without specific approval of Air Force Medical Service Center, Surgeon General 
Radiation Branch (ABfSC/SGPA), Brooks AFB, Texas 78235. 

5.6.7.4 All personnel working in areas with equipment capable of producing hazardous 
levels of RF and microwave radiation must be familiar with the sources and types of 
radiation, operating procedures, and any precautions that have been recommended in 
radiation hazard survey reports according to AFOSH 161-9. 

5.6.7.5. The Director of Base Medical Services is immediately informed of any suspected 
overexposure of personnel to RF radiation and is requested to assist in evaluation of 
the incident and preparation of the investigation report according to AFOSH 161-9. 



5.6.7.6. A visual inspection of hazardous areas, prior to operation, shall be 
accomplished to ensure warning lights are operative, barriers are in place, and 
restricted areas are clear of personnel. 

5.6.7.7. Transmitter and antenna orientation electrical limit switches are chaeked by 
system personnel daily, prior to operation, to make sure they are functioning. These 
checks are performed at low output power. 

5,6,8. Radioactive materials and nuclear operations - radioactive materials or 
assemblies must be handled under the supervision of an Nuclear Regulatory Commision 
(NRC) licensed individual or a custodian appointed by an EC licensed contractor. This 
person is normally called the Radiation Control Officer. Operations are monitored off 
and on the complexes and are coordinated with HSMC/SE and Bioenvironmental Engineering 
Services, Procedures are according to VAFBR 161-1. 

5,6,8,1. All procedures for handling isotopes require HSMC/SE and Bioenvironnienta] 



5.6.8.2. Unattended radioactive material must be secured to prevent unauthorized access 
and handling at all times. 

5.6.8.3. The launch agency must follow HSMC mishap reporting procedures if radioactive 
material is spilled, released, or dispersed either by design or accident. 

5.6.9. Confined space and tank entry will be according to TO 00-25-235 and other 
appropriate Air Force publications. All procedures, checklists, and directives are 
coordinated and approved by HSMC/SE prior to implementation. Written procedures for 
tank entry shall include instructions on tank purging and decontamination, and use of 
vapor detector or explosion and oxygen meter, as required. The "Buddy System" and 
specific requirements for protective clothing, equipment, respiratory devices, 
communications equipment, and fire precautions must be included in the written 
procedures. Tank entry is classified as a hazardous operation and is scheduled on a 
MOSR. 

5.6.10. Laser and maser systems: 



5.6.10.2. The Range user is responsible for compliance with bio-environiffinta! hazard 
survey recommendations and for establishing safety operating procedures. 



5.6.13. Cranes and lifting devices: 

5.6.11.1. New, modified, relocated, or extensively repaired cranes and lifting devices 
must be validated by functional tests prior to being approved for operational use. 

5.6.11.2. All tests conducted at WSHC will be performed using written procedures that 
include emergency shutdown procedures, safety control areas, warning systems and 
barriers, task supervisor, and operator responsibilities. 
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5,6,11,4, All cranes, hoists, and other lifting equipment used or operated at WSHC for 
permanent or short-time use, whether DGD-contractor owned, rented, or leased, must be 
properly inspected, tested, and must show proof of tests according to applicable ANSI 
B30 series safety codes. (T.0, 36-1-58 will be enforced wherever applicable.) In 
particular, items covered by 5.6.11.4.1, 5.6.11.4.2, and 5.6.11.6 below, are subject to 
validation. Additionally, all lifting equipment, slings, and auxiliary equipment 
receives preoperational inspection and periodic testing to mate sure of safe conditions 
and equipment integrity before the equipment is used. Frayed or kinked wire ropes, 
damaged or missing components, damaged or cracked welds or structural parts, fluid 
leaks, or evidence of heating oust be corrected prior to use. The above retjui rements 
also apply to cranes, hoists, or lifting equipment that has been modified or altered, or 
that has had its support structure modified or altered. 

5.6.11.4.1. The ANSI B30 series for lifting equipment are the basic documents for 
proof-testing requirements and are supplemented by the critical and noncritical load 
test criteria listed in 5.6.11,5, 5.6J1.6, and 5.6.11.7 below. Maximum safe working 
loads shall be posted on all lifting and hoisting equipment and fixtures. Weights 
utilized for load testing must be tagged and adequately marked indicating total weight 
in pounds (lbs) and owner or agency identificaion number. Reinforcing (rebar) steel 
will not be used for weight lift points. 

5.6.11.4.1.1. A 125 percent (110 for mobile cranes) proof-load test must be conducted. 
The proof-load must be hoisted, held for a predetermined time, raised again, held, 
lowered, held again, and then lowered to the ground. See attachment 4 for frequency 
schedule. 

5.6.11.4.1.2. A 10O percent minimum load test (not to exceed 125 percent for overhead 
cranes or 110 percent for mobile cranes) must be conducted on cranes where the load is 
hoisted, held for a predetermined time, raised again, exercised through its operational 
envelope, lowered, held again, and then lowered to the ground. In the event the 
operational load is less than the rated load, the crane may be qualified to the 
operational load only, in such cases, the lesser load will be exercised through the 
crane envelope. Exceptions require case-by-case approval. 

5.6.11.4.1.3. A test of mechanical and electrical controls, limit switches, and safety 
devices must be performed through the complete operational range without a load. 

5.6.11.4.2. Magnetic particle or other suitable nondestructive inspections (IIDI) must 
be performed annually on all hooks, shackles or eye bolts, links, and single failure 
point welds used for lifting critical and high value ordnance items, spacecraft, and 
missile components. Associated lifting hardware (slings, thimbles, shackles, links, 
eyebolts, swaged fittings, wire ropes, etc.) other than hooks used for lifting 
noncritical items, do not need HDI testing, but must comply with the testing, 
inspection, and maintenance requirements Set forth in applicable ANSI B30 series, OSHA, 
1910,184, and T.0. 36-1-58, and other appropriate documentation. Exceptions require 
case-by-case approval. 

5.6.11.4.3. In addition to the ANSI definitions, WSHC defines critical loads as 
including, but not limited to, high-value ordnance or propellant items, missile 
components, spacecraft, other space hardware, and unique or high value items of missile 
systems or support and facility equipment. 

5.6.11.4.4. Attachment 4 provides the frequency requirements for crane tests and 
inspections at WSMC. Each crane is assigned a category according to its use and 
environment, and crane tests are then based on the category assigned, and according to 
applicable standards. Periodic inspectons must be performed by an appointed or 
authorized person. Inspection records or copies will be maintained at facilities 
wherever cranes are installed or maintained. 
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5.6.11.4.5, Crane and hoist controls, such as pendants, push-button stations, and 
operator stations, must be configured and identified according to ANSI B3Q.2, B30.ll, 
B3Q.16, and Crane Manufacturer's Association of America (CMMA) 70 and 74. For trolley 
and bridge movement, compass points (north, south, east, and west) are preferred 
identification for the controls, 

5.6.11.4.6. Recognized standards such as CHHA, Material Handling Institute (MH1), ANSI, 
Society of Automotive Engineers (SAE), in conjunction with AFSC Design Handbook 1-6, 
System Safety, will be utilized to the maximum extent in design or modification of 
cranes. Crane design or modification specifications must be submitted to HSHC/SE for 
coordination and approval. Specification submittals must include statements requiring 
crane manufacturers to submit certificates of acceptable conformance to the above 
standards. 



5.6.11.4.8. Personnel will not be permitted to work under suspended loads n 
loads be transported over inhabited work stations. 



5.6.11.5.1. Critical loads as defined in 5.6.11.4.3 above, will be initially tested to 
125 percent of the rated load, and annually thereafter to 100 percent of rated load. 

5.6.11.5.2. Noncritical loads will be initially tested to 125 percent of the rated load 
and every two years thereafter to 100 percent of rated load, 

5.6.11.6. Crawler, locomotive, and truck mounted cranes, lifting critical loads as 
defined in 5.6.11.4.3 above, will be initially tested at HO percent of the rated load 
and annually thereafter at 100 percent of the rated load. Such cranes, lifting 
noncritical loads, will be tested initially at I 10 percent of the rated load and every 
two years thereafter at 100 percent of rated load. 

5.6.11.7. Base-mounted drum hoists, lifting critical loads as defined in 5.6.11.4.3 
above, will be initially tested at 110 percent of. the rated load and annually thereafter 
at 100 percent of rated load. Such hoists, lifting noncritical loads, will be initially 
tested at 1 10 percent of the rated load and every two years thereafter at I0D percent of 



5.6.11.8. All slings, riggers hardware, and special lifting fixtures will be 
proof-tested to 200 percent of the rated load prior to initial use at MSMC or after any 
modification or alteration. Synthetic slings must have a design margin so the proof 
load will not stress the fibers greater than their working strength. 

5.6.11.8.1. Slings, riggers hardware, and specialized lifting fixtures used to lift 
critical loads as defined in 5.6.11.4,3 above, will be tested annually to 200 percent of 
rated load, 

5.6.31.8.2, Slings, riggers hardware, and special lifting fixtures used to lift 
noncritical loads will be proof-tested according to 5.6.11.8 above and then periodically 
tested at the discretion of the user, not to exceed a three-year interval. This load 
test must not be used as a substitute for inspections and must not exceed 200 percent of 
the rated load. 



5,6.11.8.3. The proof-load for single leg slings and endless slings must be two time: 
the vertical-orientation rated capacity. 

5,6.11.8.1. The proof-load for multiple leg bridle slings will be applied to the 
individual legs and must be two times the vertical-orientation rated capacity of a 
single leg sling of the same size, giade, and construction of rope. 

5.6.11.8.5. All slings must be visually inspected each day prior to use. A periodic 
inspection must be performed by the using organization on a regular basis (annually a; 
minimus!) with frequency of inspection based on: 

5.6.11.8.5.1, Frequency of sling use. 

5.6.11.8.5.2, Severity of service conditions. 

5.6.11.8.5.3, Nature of lifts being made. 



5.6.11.8.5,5. Any deterioration that could result in appreciable loss of original 
strength must be carefully noted and a determination made whether or not further use of 
the sling would constitute a haaard, 

5.6.11.8.6. The identification and record-keeping requirements of ANSI B30.9 and OSHA 
1910,184 must be applied, identification tags, as a minimum, must indicate inspection 
dates, proof-test dates, and load rating. Identification tags and records for all 
slings must be maintained by the user. 

5.6.11.8.7. Wire rope slings must be renoved from service immediately if any of the 
conditions listed below exist. Sling assemblies must be repaired, refurbished, and 
retested before further use is permitted. 



5.6.11.8.7.2, One-third of the original diameter of the outside individual wires a 
worn or scraped away. 

5.6.11.8.7.3. The wire rope structure is distorted by kinking, crushing, birdcagir 



5.6.11.8.7.4. Heat damage is evident. 

5.6.11.8.7.5. End attachments are cracked, deformed, or worn. 

5.6.11.8.7.6. The rope or end attachment is corroded, 

5.6.11.9. If hooks have been opened more than 15 percent of the noma! throat opening, 
measured at the narrowest point, or twisted more than 10 degrees from the plane of the 
unbent hook, they must be removed from service. All books Shall be equipped with a 
safety latching device. 

5.6.11.10, Hydracranes and chainfalls must be given an initial load test and an annual 
test thereafter to 110 percent of rated load for hydracranes and 125 percent for 
chainfalls. 
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5.6.11. 11. Hydrasets must be initially load tested to 200 percent and annually 
thereafter at 125 percent. They will be tested to 125 percent when seals are replace-!. 
Manufacturer's certification of tests is acceptable for new and reworked hydrasets. 

5.6.11.12, Spacecraft, payload, and missile slings which have components that are 
norma liy disassembled shell be either marked, coded, or tethered to assure proper 
assembly of verified hardware. Components not marked, coded, or tethered will 
invalidate the proof-load certification of the whole assembly, 

5,6.12. Elevators: 

5.6.12.1. Elevators are inspected and tested as required by applicable Air Force, ANSI 
AI7.3 and A17.2 requirements. 

5.6.12.2. Elevators at missile facilities must be equipped with emergency lights or 
lights tied into a backup emergency electrical system, a telephone, and a PA speaker 
where a PA system is available and in use, 

5.6.12.3. Passenger elevators must not be used for freight, ordnance, propellant or 
other hazardous commodity without specific approval of WSMC/SE. 

5.6.32.4. Freight elevators used for the movement of ordnance that has been removed 
from original shipping containers, toxic propellants, or other hazardous coraiiodity are 
controlled remotely. Personnel must not ride in the elevator during movement of the 
above commodities. Exceptions to the above must be approved by HSKC/SE on a 
case-by-case basis. 

5.7. Mishap Reporting. HSHC/SE is responsible for reporting all ground, missile, and 
space mishaps occurring to resources under the control of the KSHC/CC. HSHC/SEH is 
responsible for participating in the investigation and making sure required reports are 
accomplished according to AFR 127-4, as supplemented, and AFR 127-2. Range users must 
make sure all mishaps are properly documented and expeditiously reported to USMC/SEM. 

5.8. launch operations: 

5.8.1. Minimum launch requirements: 

5.8.1.1. The CSO is the Range Commander's representative for ground safety at the 
launch complex and in the blockhouse. At the time specified in the applicable documents 
(user launch countdown and precount), the CSO must be on station at the safety console 
in the blockhouse or launch control center. 

5.8.1.2. The CSO is responsible for clearing all nonessential personnel from the pad 
danger area during caution periods and for proper housing of essential personnel in the 
missile flight hazard area during danger periods. The CSO controls all signaling 
services provided to indicate caution and danger periods. Caution and danger periods 
are declared by the CSO at the times specified by applicable safety plans, countdown 
manuals^ hazardous operation procedures, or at any time such action becomes necessary in 
the interest of safety. At a mutually agreed upon point in the countdown, the CSO must 
report verbally to the MFCO that "The danger area is clear for launch." 

5.8.1.3. The blockhouse door security guard does not permit anyone to leave tha 
blockhouse unless specifically authorized by the CSO. 

5.8.1.4. Searchlight and photographic supervisors must report to pad safety when 
clearing the complex and upon arrival at the fallback position. 
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5.8.1.5. In addition, the CSO must; 

5.8.1.5.1. Make sure a launch support team is in place at the fallback position for 
each static firing or launch. 

5.8.1.5.2, Monitor the installation and electrical hookup of ordnance for safety. 
5.0,1.5,3. Approve the start of ordnance tasks. 

5.8.1.5.4, Approve the start of propellant transfer and vehicle tanking. 

5.8.1.5.5. Approve the start of vehicle pressurization. 
5.8.2 Launch abort, misfire, or hangfire requirements: 

5.8.2.1. Liquid and solid propellant vehicles - in the event of launch abort, hangfire, 
or misfire, the launch agency must disable the ignition firing circuit and depressurize 
the missile propellant tanks and pressure receivers to safe values. For missiles 
employing solid propellant starting devices, the CSO must restrict access to the pad 
until it can be verified that power did not reach the initiator {misfire}, or it is 
assumed that power did reach the initiator (hangfire) and at least a 30-minute waiting 
period has elasped. 

5.8.2.2. The CSO, in conjunction with the launch agency, will inspect the pad and allow 
access to it for work when it is safe to do so. When no further launch attempt is 
contemplated, verify that hazardous ordnance items are disconnected electronically and, 
if required, removed for return to the storage area. 

5.8.3. Launch Support Team (LST} is responsible for immediate response to a missile and 
space vehicle abort on the launch pad or impacting on the VAF8 land mass or the public 
domain. The duties and responsibilities of the LST are further defined in 1 STRADR 
127-200. 

5.8.3.1. The Range user is responsible for having the required missile launch crew at 
fallback area at least 60 minutes prior to T»0. (If lore than one fallback position is 
used, the crew should report to the primary fallback area.} 

5.8.4. Post Launch Requirements: 

5.0.4.1. Immediately after a launch, the CST inspects the pad for personnel hazards, 
such as contamination, exposed wiring, damaged high pressure systems, or damaged 
propellant tanking systems. 

5.8.4.2. The CSO coordinates with the LST chief, the Range Safety Officer, and the 
launch agency to determine when it is safe to permit personnel to leave the blockhouse 
or shelter. 

5.8.4.3. The CSO directs the LST chief to adjust or lift roadblocks as warranted by 
existing conditions. Fire, medical, and security support is released when no longer 
needed and normal security measures are instituted. 

5,9. Construction Contractors: 

5.9.1. Construction contractors must comply with Corps of Engineers (COE) 5.9.25-1-1, 
when applicable, 0SHA, Air Force and other recognized standards for operations that 
involve construction, refurbishing, installation, and maintenance activities. 
Contractors must protect the health and safety of workers and all subcontractors who 
come in contact with their operation or services. Contractors muse establish; 
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5.9.1.1. Safe operating procedures. 

5.9.1.2. Accident investigation and reporting procedures. 

5.9.1.3. Medical treatment and first aid instructions. 

5.9.1.4. Prpcedures for correcting hazards. 

5.9.1.5. Security and smoking regulations. 

5.9.1.6. Instructions for placement of barriers, warning signs, and lights. 

5.9.1.7. Procedures for the use of protective clothing and equipment. 

5.9.1.8. Schedule of safety inspections of work site. 

5.9.2. Each construction contractor shall appoint a formally trained individual to act 
as his safety representative. The appointed individual functions as the single point of 
contact on all problems involving job site safety. The prime contractor's safety 
representative establishes coordination procedures with WSHC/SE and subcontractor safety 
personnel. During performance of work, each contractor must comply with all provisions 
and procedures prescribed for the control and safety of his people and visitors to the 
job site. Ihe contractor must maintain an accurate record of all accidents and 
incidents resulting in property damage, injury, or death relating to the work 
performed. A procedure to promptly notify the administrative contracting officer and 
WSHC/SE when an accident or incident occurs must be in effect. 

5.9.3. The Administrative Contracting Officer [AGO] must notify the prime contractor of 
reported safety violations and advise them to take corrective action. The affected 
contractor raust take prompt corrective action on all violations noted. Failure to 
correct safety deficiencies is basis for stopping all or part of the work until 
satisfactory corrective action is completed, WSHC/SE shall be advised of corrective 
action taken on violations found during VSHC/SE inspections. The AGO will notify 
WSHC/SEM of preconstruction briefings. 

5.9.4. The prime contractor is responsible for making sure job sites are inspected and 
monitored for safety deficiencies and must ensure that prompt action is taken to correct 
deficiencies. 
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6.5.2.3. A failure occurs in the mandatory flight safety tracking, telemetry, or data 
processing systems. 

6.5.2.4. Predicted mission hazards are excessive. 

6.5.2.5. A positive means of preventing launch during a flight safety hold is required. 

6.6. Misfire and Hangfire. The missile countdown procedure must include misfire and 
hangfire procedures. In the event of a misfire or hangfire, the flight termination 
system must remain in a launch node (araed and on nissile power) until all of the 
following have been accomplished: 

6.6.1. The missile launch control system is deactivated (for exasple, launch commands 
have been inhibited and engine ignitor SSA devices have been safed). Tile specific 
procedure acceptable to WSHC/SE depends on the type and nature of the missile system and 
launch facility. 

6.6.2. For solid propellant oissiles* a m'nisusi waiting period of 30 minutes is 
required whenever it cannot be positively identified that ignition current did not reach 
the igniter bridgesrires. 

6.6.3. Approval has been received froct the KFCO to deactivate the flight termination 



6.7. Missile Lift-off Signal. The stissile launch systea aust provide a positive 
lift-off indication to the Range for the purpose of initiating Range instrumentation and 
data processing sequences. 

6.8. Crew tine restrictions and fatigue precautions, paragraph 5.6.1.3. 

6.1 Range Safety Instrunentation Requirements. Specific instrumentation support 
requireoents for each pissile and space launch prograa will be documented by the Missile 
Flight Control Operations Requirecents generated by MSf'C/SEO. 

6.10. Flight Terainatian Actions. Flight teraination action by the HFCO (rill consist 
of thrust termination and destruct. In some cases, destruct action asy not be required 
subsequent to thrust termination. If HFCO reaction tines prove inadequate to provide 
the level of safety required, flight termination may be required to be initiated 
automatically by computer. Any plans for computer generated flight termination will be 
coordinated with the range user. 

6.11. Flight Termination Criteria. The following conditions trill noraally require 
flight termination by the ffCO: 

6.11.1. Obviously erratic flight - vehicle performance is such that continuation of 
erratic flight can bring about loss of flight termination control. This action may be 
taken even though the vehicle has not violated the flight termination lines. 

6.11.2. Flight abort line violation - data show that the vehicle violates the flight 
abort lines derived and defined by the Flight Analysis Division (WSHC/SEY). 

6.11.3. Perfo.Tiance unknown - vehicle performance is unknown and the capability to 
violate an impact limit line exists. 



IISKR 137-1 IS Bay 1 985 

6.12. Mission rales - mission rules generated by the HSHC/SEO Hill specify 
mission-peculiar details or modifications of the general operational requirements 
covered in this chapter. 

OFFICIAL LAWREEE t. GOOCH, Colonel, USAF 



siibhart of changes 

This regulation has been completely revised, reorganized, and updated; the basic 
premises of Range Safety and the philosophy of operation have not changed and the sole 
purpose in reissuing this regulation is to clarify and update flange procedures and 
operational requirements. 
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EXPLANATION OF TERMS AND ABBREVIATION 

ACCEPTABLE HAZARD. The acceptability of any hazard inposed by a nissile or orbital 
vehicle launched fns or into the Range is solely the responsibility of the Coaaander. 
The level of acceptability varies with operational requirenents and is determined by the 
Colander on a case-by-case basis after a thorough review. 

ACCEPTED RISK. A residential hazard which after thorough review and evaluation has been 
accepted by program management. 

ADEQUATE SOURCE. A data source that enables the ffCO to determine when a nissile or 
space vehicle violates established in-flight safety criteria. 

AEC. Atoaic energy amission. 

AEP.0DY1WIIC VEHICLE. A vehicle that has lifting and control surfaces to provide 
stability control and saneuverability. The flight profile during and after thrust 
depends prioarily upon aerodynanic forces. 

AFCO. Ail fuel cutoff. 

AFOSH. Air Force Occupational Safety and Health. 

AFSC. Air Force Systeas tarand. 

AFSll. Air Force Weapons Lab. 

AGC. Automatic gain control. 

AGE. Aarospace ground equipment. 

ALGORITHM. A finite set of wll-defined rules for the solution of a probleo in a finite 



AS3ER THE. The period of tine betseen nissile lift-off and the first possibility of a 
nissile's instantaneous impact point swing to a protected area. Iloraally, a nissile is 
destroyed if it is not being tracked at the expiration of tie asber tine period. 

AIISI. Agsrican national Standards Institute. 

AOS. Acquisition of signal. 

APPLICATION SOFTWARE. Software specifically produced for the functional use of a 
computer systeu; for example, software for navigation, payload, genera! ledger. 
Contrast with systen software. 

ARAR. Accident risk assessoent report. 

ASHING PLUG. A removable device that provides electrical continuity when inserted in a 
firing circuit. 

ARMING STATION. A protected location within the launch complex containing the nissile 
igniter firing circuit where the aiming plug nay be installed (firing or arming). 

ARTC. Air route traffic control. 
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ASHE. American Standard of Mechanical Engineers. 

AUTHORIZED PERSOHHEL. Those personnel who have security and safety badges, but are 
prohibited entry into safety control areas because of not meeting the requirements of 
essential or mission essential personnel. 

AUTOMATION. The use of software to perform tasks with niniei'si operator action or 



AUXILIARY EllGlHE. A power source used to operate parts of the integral equipaent (such 
as a gasoline-powered electric generator). 



AVE. Airborne vehicle equipment. 



Binary coded decinal {5-bit character code}. 
. Booster engine cutoff. 



SET. Best esticate of trajectory. 



BLOCK QiAfSAH. A diagraa of z systea, a coeputer, or a device in which the principal 
parts are represented by suitably annotated geometrical figures to shew both the basic 
functions of the parts and their functional relationships. Contrast with flowchart* 

BOA. Sroad ocean area. 



CASPER. Contact areas sucnary position estimate report. 

CATEGORY A OSDHAKCE DEVICES- Category A electro-explosive devices are those that, by 
the expenditure of their own energy or because they initiate a chain of events, cay 
cause injury or death to people or damage to property. 

CATEGORY B GRDBAIICE DEVICES. Category fi 
not, in themselves, or by initiating a c 
to property. 

CCT. CosEjand control transmitter. 

CCTV. Closed circuit television. 

CD. Common digitizer. 

CDF. Confined detonating fuse. 

CDR. Critical design review. 
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CBflTRAL PROCESSING UNIT (CPU). The central electronic device which actually executes 
the software. (Usually surrounded by peripheral devices such as neniory, buffers, 
decoders, etc., which allow interaction with the rest of the system involved.) 

CEP. Circle of equal probability, also called circular error probable, circle of 
probable error. 

CFR. Code of Federal Regulations. 

CG. Center of gravity. 

CHECK CHANNEL A single tone modulation utilized as a monitor for checkout and inflight 
performance of the receiver-decoder. 

CHOCK* Any piece of material used to prevent notion of a wheel or roller beyond the 
point of application until the chock is removed. 

CL. Checklist. 

CLARITY, The functions and operation of the programs are easily understood from the 
user EHiraal, and the progran design and structure are readily apparent frop the listing 
of progran stateaents. This ceans that the docuwntation oust be well written, but also 
that the progran is carefully designed, with reaningful choices of variable nanes, use 
of known algorithms, frequent and effective consents in the prograa to describe its 
operation, and a nodular structure that isolates separate functions for examination, 

CKAA. Crane Manufacturers Association of Anerica. 

tSO - COMPLEX SAFETY OFFICER. A representative of the VSHC or I STRAP Coanander, 
specifically qualified and designated to conitor and supervise the safety aspects of 
sissile launch preparations and operations. 

CST - COMPLEX SAFETY TECHliiCIAK. The on-site representative of the CSO responsible for 
verifying, advising, and assisting the CSO during hazardous or dangerous operations. 

COE. Corps of Engineers. 

COMPUTER PROGRAK, A sequence of instructions suitable for processing by a cooputer, 
Processing nay include the use of an assembler, a compiler, an interpreter, or a 
translator to prepare the program for execution as well as to execute it. 

COMPUTER SYSTEM. A functional unit, consisting of one or more computers and associated 
software, that uses cosran storage for all or part of a progran and also for all or part 
of the data necessary for the execution of the program; executes user-written or 
user-designated programs; perforos user-designated data oam'pulation, including 
arithmetic operations and logic operations; and that can execute programs that rcodify 
themselves during their execution. A computer system, may be a standalone unit or may 
consist of several interconnected units. Synonymous with ADP System or conpiiting system. 

CONCURRENT PROCESSES. Process that may execute in parallel on multiple processors or 
asynchronously on a single processor. Concurrent processes may interact with each 
other, and one process my suspend execution pending receipt of information from another 
process or the occurrence of an external event. Contrast with sequential processes. 
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CONFIGURATION CONTROL. The systematic evaluation, coordination, approval or 
disapproval, and Implementation of all approved changes in the configuration of a 
configuration item after formal establishment of its configuration identification. 



a. Identify and document the functional and physical characteristics of i 
configuration item. 

b. Control changes to those characteristics. 

c. Record and report change processing and implementation status. 



CORRECTNESS. Programs perform exactly and correctly all the functions expected from the 
specifications, if available, or else from the documentation. This means that incorrect 
documentation is as serious as an incorrect program. Correctness is an ideal quality 
that is rarely determinable, so a more practical quality is Reliability. 

CPR. Cardio pulmonary resuscitation. 

CRITICAL SOFTWARE HODULE. Those software aodules containing operations that, if not 
performed, performed out-of-sequence or perforated incorrectly could result in improper 
control functions (or lack of control functiors required for proper system operation) 
which could directly or indirectly cause or allow a hazardous condition to exist. 

CURRENT SENSITIVITY, The least amount of current required to initiate a particular EED 
at a specified probability and confidence level when conditions of EED temperature and 
power application are specified. 

CTSC. Center Technical Services Contractor. 

CW, Continuous wave. 

DAC. Duty air controller. 

DANGER AREA. A controlled surface area centered on the missile or applicable hazard. 
The size and shape of the area varies, depending on the nature and explosive potential 
of the propellants or other materials associated with the particular missile system 
involved and whether the operation is above or below ground level. 

DANGER PERIOD. The period of tine when the danger area is activated. 

DANGEROUS OPERATION. K specific operation requiring activation of a danger area(s) as 
specified in the appropriate missile system documentation. 

DATA FLOW DIAGRAM. A graphic representation of a system, showing data sources, data 
sinks, storage, and processes performed on data as nodes, and logical flow of data as 
links between the nodes. Synonymous with data flow graph, data flow chart. 

dB. Decibels. 

DC. Direct Current. 

DECODER ACCEPT LIMITS. The permissible tolerances to variations in interrogation code 
group pulse spacing to which the transponder will reply positively. 



HSMCR 127-1 Attachnent 1 15 Hay 1986 AI-5 

DECODED REJECT LIMITS. The variations in interrogation code group pulse spacing to 
which the transponder does not reply positively. 

DEVIATION. To depart from the enact statement of a requirement, hut at the same tine 
maintain the intent of the requirement. 

DID. Data Inforaation Description. 

OISARMSG. The normal method of returning ordnance systems or components to a safe 
status. 

DOD. Department of Defense. 

DOT. Departaent of Transportation. 

OPL - DOUBLE PROPELLAHT LOADING. An operation involving the transfer of both fuel and 
oxidizer, or of loading or unloading one propellant when the other is aboard the vehicle. 

EBH. Exploding bridgewire. 

EBH FIRMS CIRCUIT. The wiring and components that provide the high voltage and trigger 
circuits for the EBH initiator. 

EBB INITIATOR. That part of the EBH system tint initiates the explosive train by shock 
wave action due to the magneto hydrodynaaic effect. This effect is created by 
discharging a very high current, from a discharging capacitor, through the bridgewire. 

EBH SYSTEM. The combination of EBH initiator and firing circuit. 

EE0 - ELECTRO-EXPLOSIVE DEVICE. A single electrically actuated explosive initiator of 
either the HBH type and its variations or the EBH type. 

EEO FIRIIIG. The ignition or initiation of the prime explosive surrounding the 
bridgewire. 

EED FIRIIIG CIRCUIT. The m'ring and components that provide a closed path fron the power 
source to the EEO bridgewire- 

EEO LEADS. The conductors that are part of the EED [pins or pigtail) and provide an 
electrical path to the bridgewire. 

EFFICIEIICY/ECOIIOHY. Programs have high perfonaance algorithms and conservatively use 
computer resources, such as main storage, so that the cost of program operation is low. 

EMBEDDED COMPUTER SYSTEM. A computer system that is integral to a larger system whose 

primary purpose is not computational; for example, a computer system in a weapon, 

aircraft, command and control, or rapid transit system. 

EMBEDDED SOFTHASE. Software for an embedded computer system. 

HI. Electro-magnetic interference. 

ENGINE COT-OFF, The termination of the propulsion sequence by a command signal. 
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£0D ELEMENT. A section responsible for functions incident to the detection, 
identification, rendering safe, recovering, field evaluation, and disposal of ordnance 
or explosive materials that have been dropped, damaged, fired, or placed in a 
configuration that could endanger property or people. 



■f personnel trained by DOD in safing and disposing of ordnance 



ESQ. Engine shutdown. 

ESSENTIAL ACTIVITIES. Only those required activities directly related to hazardous or 
dangerous operations being performed, Normally these activities require activation of 
safety control areas. 

ESSENTIAL EQUIPMENT. Installed or portable equipment necessary to conduct a specific 
operation, 

ESSENTIAL PERSONNEL The minimum nunbor of persons necessary to successfully and safely 
complete a hazardous or dangerous operation. This tern also includes: 

a. People required to perform emergency actions according to authorized directives. 

b. Trainees required for instructional purposes. 

c. People required to perform safety or technical surveillance of the operation. 

d. People specifically authorized oy the HSHC/CC to perforn scheduled activities. 
The Range user and launch coc&ander determines, with H5MC/5E approval, the number of 
persons essential to the operations. 

FAft. Federal Aviation Agency, 

FACTORY-TO-PAEi. Factory- to-pad concept nissile systems are planned so that flight 
hardware is launch ready when the missile is shipped from the missile contractor's plant 
facility. In this concept, all possible tests and installations are accomplished by 
contractor test teams at the contractor's plant facility before shipment to the launch 



FAIL-SAFE. The ability to sustain failure and retain the capability to successfully 
terminate the mission. For GSE, the ability to sustain a failure without causing loss 
of vehicle systems or loss of personnel capability. 

FAILURE- The termination of the ability of a functional unit to perform its required 
function. The inability of a system or system component to perform a required function 
within specified limits. A failure may he produced when a fault is encountered. A 
departure of program operation from program requirements. 

FALLBACK AREA, A specified area located outside the missile flight hazard area used to 
position certain support personnel and equipment during missile launch operations as 
determined by the launch support team chief. 



FAULT TOLERAHCL The built-in capability of a system to provide continued correct 
execution in the presence of a limited number of hardware or software faults. 



FIRMWARE. Computer programs and data loaded in a class of memory that cannot be 
dynamically modified by the computer during processing. For the purposes of system 
safety, firmware is to be treated as any other piece of software. 

FLOWCHART* A graphical representation of the definition, analysis, or solution of a 
problem in which symbols are used to represent operations, data, flow, and equipment. 
Contrast with block diagram. 

FMEA. Failure node and effect analysis. 

Fo. The Range user assigned operating frequency. 

FPA. Flight plan approval. 

FTCS - aiGKT TERMINATION COHTROL SYSTEM. Equipment installed in the ctissile, plus 
associated ground equipment for tracking and tenainating missile flight should it becoae 
necessary. 

FTSA. Flight termination system analysis. 

FTSR. Flight termination systet report. 

FUHCTIOH. A specific purpose of an entity or its characteristic action. 

g-linits. Acceleration limits, 

GEHS, General energy management system. 

GENERALITY. Programs perform their functions oyer a wide range of input values and 
usage modes, Programs are not limited to special cases or range of values when the 
functions are commonly or reasonably extenuable to a nore general case. 

GERTS. General Electric Radio Tracking System. 

GSE. Ground support equipment. 

GSP, Ground safety plan. 

HANGFIRE. Ignition has not occurred and it is not known positively that the firing 
current has not reached the igniter initiators, 

HARDWARE. Physical equipment used in data processing, as opposed to computer programs, 
procedures, rules, and associated documentation. Contrast with software. 

HAZARD. The presence of a potential risk situation either caused by an unsafe act or 
condition or resident in the system by virtue of the inherent energy sources utilized in 
the system. 
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HAZARD ANALYSIS. The analysis of systems {hardware, software, firmware, and user-system 
interface) to determine potential hazards which could result in loss of personnel, 
injury to personnel, loss or degradation of the system, loss or degradation of mission 
capability or loss of life or injury to the public. The analysis must not only identify 
hazards but also must recomend actions to eliminate or control the hazards. 

HAZARD AREA. A controlled surface area centered on the hazardous operation being 
performed. The area size and shape varies and depends upon the nature of the operation, 
missile system, and materials involved. 

HAZARD PERIOD. The period of time the hazard area is activated. 

HAZARDOUS CONDITION. A situation where significant risk exists because of the nature of 
the operation being performed and materials being handled. For example, hazardous 
conditions exist: 

a. During propellant transfer to or from a missile; whenever work is in progress 
on a missile containing liquid propellants; and whenever a solid propellant missile is 
being installed or removed. 



Whenever any toxic or flactiable materials are used for any purpose. 
Whenever radioactive items deeped a hazard are introduced into any area. 

s defined in applicable Air Force regulations or 



g. Any time that electrical stores are within 10 miles of the cosiplex, or when 
meteorological forecasts predict that any adverse condition exists prior to the 
completion of any operation that cannot be terminated if ordnance items or propellants 
are aboard the missile. 

HAZARDOUS OPERATIONS. Certain functions and procedures accomplished during missile 
operations that have been designated as hazardous operations [chapter 3). These 
operations require supervision by people specifically assigned the responsibility of 
ensuring that all safety considerations are met. 

HBW. Heated bridgewire. 

HOP. Hazardous operations procedure. 

HUKAH ENGINEERING, Application of scientific knowledge to the design of items to 
achieve effective user-system integration and utilization. 

HUMAN FACTORS, includes principles and applications in areas of human engineering, 
personnel selection, training, life support, job performance aids and human performance 
evaluation. 

HUMAN PERFORMANCE. Measure of man-functions and actions in specified environment. 
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HZ. Hertz [frequency). 

IEEE. Institute of Electrical and Electronic Engineers. 

IG. Inertial guidance. 

IIP. Instantaneous impact prediction. 

ILL - IMPACT LIBIT LINE. A line defining a limit Beyond which a missile and spacecraft, 
or specified portions thereof, must not be allowed to impact. 

IMPACT AREA. The area surrounding an approved impact point. The extent and 
configuration of the area is based on the vehicle or stage dispersion characteristics. 

Ml, Interial Measurement Unit. 

INfERENT. Achievable under ideal conditions generally derived by analysis and 
potentially present in the design. 

INTEGRATION. The process of combining software elements, hardware elements, or both 
into an overall system. 



a. A shared boundary. An interface might be a hardware component to link two 
devices or it sight he a portion of storage or registers accessed by two or more 



b. To interact or couaunieate with another system component. 

INTERFACE TESTING. Testing conducted to ensure that program or system components pass 
information or control correctly to one another. 

INTERROGATION CODE PULSE SPACING. The time interval measured between SO percent 

! points on the leading edges of the interrogation code group voltage pulses. 



IONIZING RADIATION. Gamma and x-rays, alpha and beta particles and neutrons; but not 
sound or radio waves, or visible, infrared, or ultra-violet light. 

IRIG. Inter-Range instrumentation group. 

IRV. Inter-Range vector. 

Ufa. Kilohertz. 

LAAFS. Los Angeles Air Force Station. 

LAL. Launch Approved Letter. 

LAUNCH COMPLEX. Area, usually fenced, containing the missile launching facilities, 
including the launch pad and servicing structures, blockhouse or control building, 
propellant transfer equipment, support buildings, and all other facilities in the 
immediate vicinity required to support a missile launch, 

LCC - LAUNCH CONTROL CENTER. That room or area where launch operations are conducted. 

ICO - LAUNCH CONTROL OFFICER. Individual who supervises and coordinates activities in 
the launch complex during prelaunch and postlaunch. 
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LAUNCH SUPPORT PUN. A base safety support plan specifying LST elements, support 
schedule timing milestones, reporting instructions, and other special support 
instructions for a specific launch operation. 

LCSOP. Launch Complex Safety Operating Procedure {MSKCR 327-2, vol II). 

LCSP. Launch complex safety plan. 

L£L, Lower explosive limit. 

LF. Launch facilty. 

LIMITED RADIATION HO SWITCHING. That state imposed by the pad site comnander where 
switches that sight create a radio frequency hazard in the vicinity of the eciplaceaent 
are not allowed to be operated. This also applies to automobile ignition, electronic 
signal generators, and automobile radio transmitters in the vicinity. Limited radiation 
no switching periods apply when electrically fired explosives are being electrically 
connected or disconnected. 

LONOTE. Local notice to mariners. 

LO2 or LOX. Liquid oxygen. 

LOCC. Launch operations control center (Bldg 7000). 

LOS, Loss of signal. 

LST - Launch Support Teas. A teaa composed of a variety of technical specialists, 
prepositioned for rapid response to any emergency or disaster occurring during ttissile 

launch operations. 

MAC. Haxicum allowable concentration. 

HAIllTAlffABILITT. Programs are well docuaented by aanuals and internal consents and so 
well structured that another progranser could easily repair defects or oak? minor 
improveaents. Clarity is essential for maintainability. Also implied are a wide 
variety of good design attributes, such as program functions that halp to diagnose 
potential problems (such as periodic reports of status or control totals) or general 
techniques that can be readily adapted for change (such as the isolation of constants, 
report titles and other static data as named variables). 

HAK-FIIKCTIQH. Allocated to the human component of a systea. 

HDF. Mild detonating fuse. 

H£C0. Main engine cutoff. 

HFCA. Missile flight control area. 

MFCQ - MISSILE FLIGHT CONTROL OFFICER. An Air Force Officer who monitors the 
performance of missiles and space vehicles in flight and initiates flight termination 
action when required. He or she 's the direct representative of the Range Commander 
during the prelaunch countdown and during missile powered flight (MFCO is. also used by 
some Range users to designate manual fuel cutoff). 



HFCORD. Missile flight control operations requirements document. 

HFKA, Missile flight hazard area. 

MM. Material Handling Institute. 

MHz. Megahertz 

MINIMUM RADIATIOIf CONTROLLED RADIATION. Includes criteria under limited radiation nr 
switching, and is that state where all high powered radar and other high powered radio 
frequency transmitters are required to cease radiating (or to bean away). 

MISFIRE. When it is positively known that ignition voltage has not reached igniter 
initiators during a launch attsapt. 

MISSILE, Ho distinction is oade between sub-orbital, orbital, escape vehicles, and 
mssiles in this publication. All are referenced as missiles. This fcera refers to any 
category of launch vehicle, spacecraft, er coabination thereof. 

MISSILE RIGHT CAUTION AREA. That ground outside of the nissile flight hazard area 
tfherg injury or property daaage could occur because of a nissile flight failure. This 
area is restricted and only essential personnel are allowed to retain within the nissile 
flight caption area during launch operations. 

MISSILE FLIGHT HAZARD AREA. That area where significant danger to personnel and 
equiprant would exist in the event af 2 ealfanction during the early phases of nissile 
flight. It is tise ground and air space extending to an unlinited altitude, and 
including the entire area where the risl; of serious injury, death, or substantial 
property danage is so severe it necessitates exclusion of all personnel and equipnent 
not needed to conduct the launch operation. Personnel required to be in this area 
during a launch operation East be located in blast-hardened and approved shelters. 

MISSILE GROUND SAFETY. Those safety consi derations and procedures associated with, and 
peculiar to, handling of aissiles and aissile components preparatory to prelaunch, 
launch, and postlaunch in the event of inadvertent land icpact. 

MISSILE HAZARD SPACE. A vol une originating at the launch point within which a vehicle, 
its fragments, or its nuclear or toxic contamination is contained either as a result of 
its naxkHH aerodynam'c ballistic capability or controlled flight teraination. The 
nissile hazard space varies according to the characteristics of the particular vehicle 
involved and the Range safety limitation icposed for flight teraination. It nust be 
specifically prescribed for each pissile launch operation. 

MISSILE OPERATIONS. All activities involving missiles or space vehicles and their 
support systems and facilities. 

MISSILE RULES. Rules agreed upon between the Range user and W5HC specifying those 
requirements and procedures not covered in this regulation. 

HISSIOII ESSENTIAL PERSONNEL. Those personnel who do not meet the requirements of 
essential personnel, but may be permitted within safety control areas to prevent a 
mission impact. All requests to enter requires WSMC/SE approval on a case-by-case basis. 
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HODIFIABILITV. Program functions that night require major changes are well documented 
and isolated in distinct nodules. Maintainability is essential to irodifiability. 
Modifiaoility means that a concerted effort was made to anticipate major changes and to 
plan the software design so that they could be made easily. 



a. A program unit that is discrete and identifiable with respect to compiling, 
combining with other units, and loading; for example, the input to, or output from, an 
assembler, compiler, linkage editor, or executive routine. 

b. A logically separable part of a program. 

HOSP. - MISSILE OPERATIONS SUPPORT REQUlRBlEKTS. A 1 STR/P Fom 36 listing all support 
requi reaents (safety and otherwise) needed in support of a particular operation- The 
use of this fora is mandatory for all hazardous, dangerous' operations conducted at 
Vandenberg AFB. 

HSfiSA. Missile systeo ground safety approval. 

w. Milliwatt. 

II2O4. Nitrogen tetroxide. 

HASC. national Aeronautics and Space Council. 

HOI- Nondestructive inspections. 

HOT. nondestructive testing. 

NEC. National Electrical Code. 

IIFPA. national Fire Protection Association. 

HFS. Hear field signature. 

NFS. national fire standard. 

IIIOSH. national Institute of Occupational Safety and Health. 

HH. Ilautical miles. 

NO-FIRE. A failure of an EED to fire when electrical energy is applied, or the 
rendering of an EED to a permanent inoperative state without any ignition process 
occurring (dudding). 

ore than one EEO per thousand will 



W-FIRE POWER, The power sensitivity where no more than one EED per thousand will fin 
■nth a confidence of 95 percent. 



NONESSENTIAL PERSONNEL. Personnel who do not meet the criteria for essential personnel 
and whose absence would not hinder the successful completion of an operation that 
required activation of a safety control area. 



NGMNAl SENSITIVITY. The receiver decoder design guaranteed RF signal level which, when 
applied within the operating bandwidth, produces a desired output. 



NOTAM. Hotice to Airmen* 

NRC, Nuclear Regulatory Conmission. 

HSCCA. Nuclear Safety Cross Check Analysis. 

OSC. Operation and control console- 

Q$I, Operation and Maintenance. 

00, Operations directive. 

OP. Operating procedure. 

OPEN LOO? FLIGHT TERHIHATIOH COIiTROL SYSTEM VERIFICATION CHECKS. Operation checks of 
the flight termination systea using electromagnetic radiation between transmitting and 
receiving antennas. 

OPERATING BANDHIOTH, The frequency displacement fraa F sub o or the aodulated carrier 
over which a ccssand function can be initiated and maintained at the nooinal sensitivity 
level. 

OH. Operations requirements. 

ORBITAL MOTION. Orbital injection occurs when a vehicle achieves a cosbination of 
velocity and position so that without additional thrust at least one orbit of the earth 
is saade. 

OSHA. Occupational Safety and Health Act. 

OVER1HTERROGATI0H PROTECTION. The protection afforded the transponder transmitter by 
circuitry designed to limit: response rates to values that do not exceed the trans- 
mitter's oaximun duty cycle limitation. 

PA. Public address. 

PAH. Pulse amplitude modulation. 

PCM. Pulse code modulation. 

P8R. Preliminary design review. 

PEAK POWER OUTPUT. The required minimum peak power applied at the transponder antenna 
terminal under all operating conditions, normally computed from average power 
measurements. 

PEL. Permissible exposure limit. 

PETfj, Pentaerythritol tetram'trate. 
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PFE. Polytetrafluoroethylene, 

PL Program instruction. 

PIGA. Pendulous integrated gyroscopic accelerometer. 

PMfi. Precision jneasurement wjaipstent laboratory. 

PMTC. Pacific Missile Test Center. 

POSITIVE: PROTECTIOII, Provide a definite neans of protection, such as shelters, destruct 
line, or protective clothing as opposed to quasi -protection obtained frog probability 
studies. 

POTENTIAL TOXIC AREA. An area outside of which a specified naximuia concentration of 
toxic gases predicted to contain excess toxic vapors or fumes is not to occur. 

PfflJER SEHSITIYITV. The least aaount of electrical power required to initiate a 
particular E£D at a specified probability and confidence when conditions of £01 
temperature and power application are specified. 

PP. Present position. 

PRD. Program requirements document. 

PGELADNCK SAFETY PROCEDURES. Procedures involving all safety functions at the Range 
fron the receipt of trissiles, space vehicles, and components until launch- 



PRESSURE, KAXIKiifi ALLOWABLE OTUHG. The Eiaxinuo operating pressure permissible for a 
vessel at the operating temperature specified for that pressure. 

PRESSURE , OPEftATIHG. Operating pressure is tne systen pressure that is at or below the 
siaxitrua allowable working pressure. 

PRESSURE, PROOF. The test pressure applied to a pressure vessel and system without 
permanent set or defoliation adversely affecting performance or safety. 



Low Pressure to 500 psi 

Med Pressure 501 to 3000 psi 

High Pressure 3001 to 10,000 psi 

Ultra-High Pressure Above 10,000 psi 

NOTE: It pust be renembered, however, that the degree of hazard in pressure system; 
is proportional to the amount of energy stored, not the amount of pressure present. 
Therefore, low pressure, high volume systems can be as hazardous to personnel as high 
pressure systems. 
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PRF - PULSE REPETITION FREQUENCY, The number of pulses, or pulse groups in the case of 
multiple pulse codes, that occur per second. 

PROCEDURE. A portion of a computer program which is named and which performs a specific 
task, 

PROCESS. In a computer system, a unique, finite course of events defined by its purpose 
or by its effect, achieved under given conditions. 

PROGRAM. See Computer Program. 

PROPULSIVE STATE. Any configuration of a stage (or stages) of a missile that would move 
an appreciable distance in case of ignition. 

PSH. Program support manager. 

PSP. Program support plan. 

PSS. Prenature separation systea. 

PTA. Potential toxic area. 

PULSE FALL TIKE. The time required for the trailing edge of a voltage pulse to decrease 
froa 90 percent to 10 percent of the anplitude of the pulse. 

PULSE RISE TIME- The tine required for the leading edge of a voltage pulse to increase 
froa 10 percent to 90 percent of the amplitude of the pulse. 



QD. Quantity distance. 

QE. Quadrant elevation. 

RAM. Randon Access Meciory. Provides iraediate access to any storage location point in 
memory. Hay he written to as well as read during program execution. 

RANDOM TRIGGERING. The transmissions by the transponder that are not synchronized with 
valid interrogations. 

RATED OPERATING CONDITIONS. The speeds, pressures, temperatures, stresses, and 

capacities of a component, or system of components, that have been designed, tested, and 
qualified according to applicable mandatory specifications. 

RflCR - RANGE MISSILE CONTROL REPRESENTATIVE. A representative of the Range asunder 
specifically qualified and designated to make sure that the flight termination control 
system is designed properly and is operational. 

RCC. Sange Commanders' Council. 

RCCSSG. 'Range Commanders' Council Range Safety Group. 

RCO. Range Control Officer. 

M, Research department explosive {Cyclotrimethylene trinitrate). 
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REAL TIME. Pertaining to the processing of data by a computer in connection with 
another process outside the computer according to time requirements imposed by the 
outside process. This term is also used to describe systems operating in conversational 
mode, and processes that can be influenced by human intervention while they are in 
progress. 

RECEIVER BftKDWIDTH. The width of the frequency passband at the specified attenuation, 
referenced to trigger sensitivity threshold. 

RECEIVER CENTER FREQUENCY. The numerical midpoint between the tipper and lower 
frequencies of the passband, measured at points corresponding to a 3 dB signal increase 
from trigger sensitivity threshold. 

RECEIVER DYHAKIC RANGE. The range of signal levels where the transponder reply Is with 
optimum accuracy to valid stimuli. This range is described as being from dBm to a 
point 5 dBm above trigger sensitivity. 

RECEIVER TRIGGER SENSITIVITY. The minimum signal level, measured at the antenna terminal 
of the transponder, that causes the transponder to reply properly to at least 39 percent 
of the valid interrogations per second with less than 5 pps response to random noise. 

RENDER SAFE. The operation of rendering safe the ordnance systems or components to a 
safe status in the event of vehicle impact or aborted launch, or under circuEtstances 
when normal disarming cannot be accomplished. 

REPLY DELAY. The time interval between 50 percent amplitude points of a pulse voltage 
measured fron the leading edge of the last pulse of the interrogating code group to the 
leading edge of the transmitted reply pulse. 

REPLY DELAY JITTER. The pulse to pulse variation in delay at constant input signal level. 

REPLY DELAY VARIATION. The total (absolute) variation in delay to signal levels within 
the dynastic range of the transponder. 

REPLY LOCK-OUT, The protection afforded the transponder by circuitry designed to 
inhibit transmitter response curing recovery time and thus assure optimum reply 
performance. 



A condition or capability that must be pet or possessed by a system or 
system component to satisfy a contract, standard, specification, or other formally 
imposed document. The set of all requirements forms the basis for subsequent 
development of the system or system component. 

RESILIENCE. Programs continue to perform in a reasonable way despite violations of the 
assumed input and usage conventions. Input of unacceptable data or an inconsistent 
c«and should never cause a result that is astonishing and detrimental to the user. 

Rf. Radio frequency. 

f' T FIELD POWER DENSITY. The power flux density or electromagnetic waves passing 
trough a surface normal to the direction of propagation. 

Rl FIELD STRENGTH. The magnitude of the electric or magnetic field vector (E or HJ at a 
(jiven location resulting from the passage of radio waves. 
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RF PROTECTION. A state where all electronic signal generators, radio transmitters, and 
electrically powered equipment tliat operates within a specified radio frequency band 
mist be turned off if they will interfere with the operation in progress. 

RF RAOIATIOII. Electromagnetic wave propagation in the frequncy range of 0.15 HHz to 
40,000 HHz, incapable of ionizing tat capable of transferring energy into electronic and 
physiological systems. 

RF SUSCEPTIBILITY. The magnitude of the smallest RF field, expressed as an RF field 
intensity (watts meter) of RF field strength (volts meter), capable of producing a 
no-fire current or no-fire power in an FED. 

RF!. Radio frequency interference. 

RtlCR. Range Missile Control Representative. 

BIS. Root mean square. 

MM. Read Only memory. (See Firmware.) 

ROS. Range Operations Supervisor. 

ROSE. Rising observation sounding equipment. 

ROUTINE. 

a. A computer program segment tliat performs a specific task. 

b. A program, or a sequence of instructions called by a program, that may have some 
general or frequent use. 

P.PP. Radiation protection plan. 

■RSC. Range statement of capability. 

RSO. Range Safety Officer. 

RSS - RELATIVE SIGM STRENGTH, DC voltage output from the flight termination control 
system co»and receiver utilized as a monitor of the RF input to the command receiver 
decoder. 

RSV. Ready storage vessel. 

RTOHS. Real time data handling system. 

S I A - Safe and Arm Device. An electro-mechanical device used to ensure initiation of 
an ordnance train on proper command and to prohibit initiation of the train by a random 
or inadvertent firing signal or stray energy, 

SABER. Supersonic aircraft boom effects routine. 

SAC. Strategic Air Command. 

SAE. Society of Automotive Engineers. 

SAFETY. Conservation of human life and its effectiveness and the prevention of damage 
to items consistent with mission requirements. 
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SAFETY CONCERN, An accident risk factor or hazard that is considered credible and of 
such significance that it is identified to program management All safety concerns are 
documented in the ARAR and are tracked to resolution, 

SAFETY CONTROL AREA, An area where personnel and equipment exposure fs controlled in 
order to limit the risk from a hazardous or dangerous operation. 

SAFING, The action taken by the FIFCO, while the missile is in flight that precludes any 
further capability of the missile's receiving ARM or DESIRUCT, Also used to describe 
the act of reducing the state of an "Armed" ordnance device to "safe" by electrical or 
mechanical wans. 

SAR. Special access required search and rescue. 

SAS. Safety analysis suwary. 

SDO. Senior duty officer. 

SDR. System Design Review. 

SE. WSHC Range Safety Office. 

sec. Seconds, 

SECO. Sustainer engine cutoff. 

SEED. Safe eye exposure distance. 

SEH. USHC Pad and Industrial Division. 

SEO. MSHC Missile Flight Control Division. 

SEqaEHTIAL PROCESSES. Processes that execute in such a manner that one oust finish 
before the next begins. Contrast with concurrent processes. 

SES. HSMC Systen Safety Division. 

SEV. USHC Flight Analysis Division. 

SFIR. Specific force integrating receiver. 

SNA. Software Hazard Analysis. 

SHEAR PIN. A pin designed to fail before overstressing of composite parts or 
overloading of equipment occurs. 

SHIPPING HAZARD AREA. An area where the probability of a hit on a ship is unreasonably 
high. 

SHIELD. A metallic barrier that completely encloses a device for the purpose of 
preventing or reducing induced energy^ 

SOFT TREE. A fault tree which is constructed on a system which includes software 
interfacing with hardware. A software fault tree. 
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SOFTWARE. Computer programs, procedures, rules, and possibly associated documentation 
and data pertaining to the operation of a computed system. See also application 
software, system software, 

SOFTWARE DEVELOPMENT PROCESS. The process by which user needs are translated into 
software requirements, software requirements are transformed into design, the design is 
implemented in code, and the code is tested, documented, and certified for operational 



SOFTWARE ERROR. An occurrence, during the execution of a program, attributable to 
software which fails to satisfy the program performance specifications or fails to 
perfora as designed. 



SOFTWARE SAFETY. The application of system safety engineering techniques to software in 
order tc ensure and verify that the software design takes positive measures to enhance 
system safety and that errors which could reduce systea safety have been eliminated or 
controlled. 

SOFTWARE SAFETY ANALYSIS. An analysis of the software of a system element to identify 
and eliminate software errors, faults, or deficiencies relating to safety critical 
corand and control functions. 

SIC. Space launch complex. 

S/H. Signal to noise. 

SOP. Standard operating procedure. 

SPA. Storage plate assembly. 

SPECIFICATION. A document that prescribes, in a complete, precise, verifiable manner, 
the requirements, design, behavior, or other characteristics of a system or system 



SPL - SIHGLE-PROPELUWF LOADIHG. A propellant loading or unloading operation involving 
transfer of only one propellant when the other propellant is not aboard. 

SRH. Solid rocket motor. 

SRT. System readiness testing. 

SSG. Systems safety group. 

SSPP- Systems safety program plan. 

STABLIZATION TIME. The initial warm-up tints required by the transponder in order to 
perform within required operating specifications. 

STANDARD STATISTICAL TEST PROCEDURES. Bruceton or Probit statistical tests. 

STATIC FIRING. Firing an anchored vehicle engine without intent for flight. 
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STRUCTURAL MEMBER, Any structure or load carrying intergral part of a track. 

SUBROUTINE. A subprogram that is invoked by a calling statement that may or may not 
receive input values, and that returns any output values through parameter names, 
program variables, or mechanisms other than the subroutine name itself. Contrast with 

i methods organized to accomplish a set of 

SYSTEM SOFTWARE. Software designed for a specific computer system or family of computer 
systems to facilitate the operation and maintenance of the computer system and 
associated programs; for example, operating systems, compilers, utilities. 



TFE. Polytetraflouroethylene. 

TI. Technical interchange. 

TL¥. Threshold limit value. 

TH. Telemetry. 

TMFE. Telemetry front-end equipment. 

THIG. Telemetry inertia! guidance. 

T-0. Missile lift-off time. 

TIISE. Technical Nuclear Safety Evaluation. 

TO. Technical order. 

TOCC. Test operation control center. 

TRACKING AID, A beacon or transponder in the vehicle designed to aid in establishing 
its position. 

TRANSMITTER FREQUEHCY. The frequency of maximim RF energy within the transponder reply 
pulse radiation spectrum. 

TRANSPONDER RECOVERY TIME. The minimum tine interval between interrogation pulses or 
code groups required for transponder normal response to interrogation signal levels 
within its dynamic range. 

TSP. Test safety procedure. 

TT. Thrust termination. 

U5CG. United States Coast Guard. 

USEABIUTY. Programs have functions and usage techniques that are natural and 
convenient for people and show good consideration of human factors and limitations. For 
example, the programs have few arbitral codes for data input or output, have consistent 
conventions in different operating modes and provide thorough diagnostic messages for 
errors or violations of use. 
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VAFB. Vandenberg Air Force Base. 

.VALIDITY. Programs provide the performance, all functions and appropriate interfaces to 
other software components that are sufficient for beneficial application in the intended 
user environment. This means that the software, without additional programing or 
manual intervention, has the capabilities that reasonably would be expected for its 
purpose. Validity is a quality of specifications as well as computer programs. 
Examples of an invalid program would be an interactive editor that had no on-line 
function for retrieving stored text for inspection or a FORTRAN language compiler that 
had no DO LOOP implementation. Validity involves judgement of user requirements and lay 
change if the intended application or purpose is altered. Because poor reliability nay 
render a needed function useless, reliability is necessary to validity. 

VDC. Volts direct current. 

VECO. Vernier engine cutoff. 

VIPS. Vandenberg impact prediction system. 

Vras. Volts root mean square. 

VSHR. Voltage standing wave ratio. 

HDR. Ket dress rehearsal. 



KCOGA. liest Coast Offshore Operating Area. 

MUDS. Heather information network display system. 

HSMC. Hestern Space and Missile Center. 

KSS. Dire skyscreen. 

«TR. Hestern Test Range. 

1 STRAD. 1st Strategic Aerospace Division, 
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REFERENCE MATERIALS 

Government documents and appropriate publications f™ other sources considered relevant 
to this regulation. Latest revisions should he used unless otherwise indicated. 



1. Air Force Publications. 

AFR 11-1 - host-Tenant Support Responsibilities of USAF Organizations 

AFR 19-2 - Environmental Impact Analysis Pocess, (EIAP1 

AFR 55-34 - Reducing Flight Disturbances 

AFR 71-4 

AFR 80-14 - Test and Evaluation 

AFP 85-1 - Electrical Facilities Safe Practices 1 

ABi 88 Series - Facility Design and Planning 

AFH 91-13 

AFR 91-28 

AFR 92-1 - Fire Protection Program 

AFR 100-6 - Electromagnetic Interference and Radiation Hazards 

AFR 1 22-1 S - Nuclear Power System Safety Reviews and Surveys 
AFR 122-16 

AFR 12'-* - Investigating and Reporting OS Air Force Hishaps 

AFR 127-12 - Air Force Occupational Safety and Health Program (PA) 

AFR 1 27-1 00 - Explosive Safety Standards 

AFR 136-6 (S) Command Disable System (COS) (II) 

AFR 136-10 - Air Force Explosive Ordnance Disposal Program 

AFR 160-24 - Standards for Blood Banks and Transfusion Services 

AFR 160-32 - Clinical Laboratory Classification and Capabilities 

AFR 161-1 - Control of Vector Borne Diseases 

AFR 161-2 - Aerospace Systems Hanageient-Hedical 



AFR 161-6 - Control of Conmuinicable Diseases 

AFR 161-8 - Control and Becoming Procedures-Occupational Exposure to 
Ionizing Radiation 

AFR 161-11 -Cold Injury 

AFP. 161-16 - Radioactive Material Licenses and Permits 

AFM 161-30 - Chemical Rocket/Propellant HazanJs 

AFM 161-30, Vol 1 - Solid Rocket/Propellants 

Affl 161-30, Vol 2 - Liquid Propellants 

AFR 161-35 - Hazardous Hoise Exposure 

AFR 207-24 - (S) Systen Security Standard - Space Launch Complexes (II) 

AFR 800-14, Vol 2 - Acquisition and Support Procedures for Coaputer Resources 
in Systens 

AFR 800-15, SD Sup 1 - Hunan Factors Engineering and ttanageaent 

AFR 800-16 - II9F Sjsten Safety Prograas 

2. Air Force Occupational Safety and Health Standards (AFOSH STO). 

AFOSH SID 127-1 - Balking Surfaces 

AFOSH STO 127-2 - Guarding Floor and Hall Openings/Holes 

AFOSH SID 127-3 - Fixed Industrial Stairs 

AFOSH STO 127-6 - Fixed ladders 

AFOSH STO 127-7 - Scaffolding 

AFOSH STD 127-9 



AFOSH STO 127-11 - Electrical Installations and Equfpaent 

AFOSH STD 127-31 - Personal Protective Clothing and Equipment 

AFOSH STO 127-38 - Hydrocarbon Fuels General 

AFOSH STD 127-39 - Fuel Servicing Operations 
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AFOSH STD 127-40 - Fuel Storage Systeas 

AFOSH STD 127-59 - Dry Chenical Installed Fire Extinguishing Systens 

AFOSH STD 127-60 - Carbon Dioxide Installed Fire Extinguishing Systems 

AFOSH STB 127-62 - Standpipe and Hose Systeos 

AFOSH STD 127-63 - Fire Alan and Detection Systeos 

AFOSH STD 127-66 - General Industrial Operations 

AFOSH STD 161-1 - Respiratory Protection Progran 

AFOSH STD 161-8 - Permissible Exposure Limits for Chemical Substances 

AFOSH STD 161-9 - Exposure to Radiofrequency Radiation 

AFOSH STD 161-10 - Health Hazards Control for User Radiation 

AFOSH STD 161-13 - Exposure to Hydrazine 

3. Anerican national Standards Institute Publications. 

AtlSI A10.4 - Safety Requirements for Personnel's Hoist 

A11SI A12.1 

ANSI A13.1 - Schese for the Identification of Piping Systeos 

A1ISI A14.3 - Safety Requireoents for Fixed Ladders 

ANSI A17.1 - Safety Code for Elevators and Escalators 

AIISI A17.2 - Practice for the Inspection of Elevators, Escalators and 
Moving Walks (including A17.2a) 

AIISI A50.1 - Building Code Requirements for Hiniciua Design Loads for 
Buildings and Other Structures 

AIISI A90.1 - Safety Standard for Manlifts 



- Safety Standard for Compressors for Process Industries 

- Jacks 
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ANSI S30.3 - SI i ngs 

MSI B30.10 - Hook: 

ANSI B30.ll - Monorail and Undsrhong Cranes 

ANSI 830.16 - overhead Hoists 

AIISI 831.1 - Pover Piping, (including Addendaent B31.1a and B31.1bl 

AIISI 856.1 - lo» Lift and High Lift Trucks 

ANSI B57.1 - Conpressed Gas Cylinder Valve Outlet and Inlet Connections 

AIISI C2.2 

AIISI C39.5 

AIISI C95.1 

AIISI 07.1 

AHSI K13.1 

AIISI »,1 

AIISI Z9.2 



AIISI Z9.3 - Safety Code for the Design, Construction and Ventilation 

of Spray Finishing Operations 



4. Code of Federal Regulations. 
CFR Title 10 - Energy 

CFR Title 29 - labor (0SHA1 

CFR Title 49 - Transportation 

5. Crane Manufacturers Association of America Specifications. 
CHAA 70 - Electric Overhead Cranes 

CMAA 74 - Monorails 

6. Air Force Systei Conaand (AFSC) Oesign Handbooks. 
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DK ]-3 - Human Factors Engineering 

OH 1-6 - System Safety 

DH 3-3 - Ground Equipment and Facilities 

7. Data Iten Descriptions. 

DI-H-7047 - Systems Safety Program Plan 

DI-S-30564 

DI-S-30565A - Accident Risk Assessment Report 

8. Departeent of Defense Publications. 
DODD 3200.11 

DODM 4145-26 - DOD Contractors Safety Manual for fenunition, Explosives, 

and Related Dangerous Materials 

DODil 4270-1 
O0DS 6055-9 

9. 1st Strategic Aerospace 



1 STRAOR 127-200 - Hissile Mishap Prevention 

10. General Orders, California Public Utility Conaission. 
G.O. 95 - Rules for Overhead Line Construction 
G.O. 128 

11. Military Specifications and Standards. 

DOD-STD-480A - Configuration Cc 

Waivers 

D0D-STD-1679A - Military Standards for Softiare Development 

MIL-B-5087B - Bonding, Electrical and Lightning Protection for Aerospace 

Systems 



WL-B-78B3B - Brazing of Steels, Copper, Copper Alloys, Nickel Alloys, 

Aluminum and Aluminum Alloys 

MIL-E-4158E - General Requirements for Electronic Equipment Ground 

MIL-H-46055 
HIL-HDBK-5C 

MIL-M-8090F 

HIL-P-5518C - Pnuematic Systems, Aircraft, Design, Installation, and Data 

Requirements for Supplement 1 

WI-Q-9858A - Quality Program Requirements 

H1L-S-52779 - Software Quality Assurance Program Requirements 

HIL-STD-101B - Color Code for Pipelines and for Compressed Gas Cylinders 

HIL-STD-172B - Color Code for Containers of Liquid Propellants 

aiL-ST0-4S4« - Standard General Requirements for Electronic Equipment 

MIL-STD-461B - Electromagnetic Emission and Susceptibility Requirements 

for the Control of Electro-magnetic Interference 

HIL-STD-462 - Measurement of Electromagnetic Interference Characteristics 

HIL-STO-483 - Configuration Management Practices for Systems, Equipments, 

Munitions and Computer Programs 

HIL-STD-490 - Specification Practices 

BIL-STO-721 

IIIL-STD-785B 

BIL-STD-826A 

MIL-STD-882B - System Safety Program Requirements 

MIL-STD-962 - Outline of Forms and Instruction for the Preparation of 

Military Standards and Military Handbooks 

HIL-STD-965 - Parts Control Program 

HIL-STD-1247B - Marking, Functions and Hazards Designations of Hose, Pipe 

and Tube Lines for Aircraft, Missile and 
Space Systems 
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MIL-STD-1385 - General Requirements for Preclusion of Ordnance Hazards in 

Electromagnetic Fields 

MII-STD-1472C 

HIL-STD-I612 

MIL-STP-1521 - Technical Reviews and Audits for Systems, Equipment and 

Computer Programs 

MIl-STD-1522 - standard General Requirements for Safe Design and Operation 

of Pressurized Missile and Space Systems 

MII.-STD-1540A - Test Requirements for Space Vehicles 

HIL-STB-1 541 - Electromagnetic Compatibility Requirements for Space Systems 

MIL-STD-I542 - Electromagnetic Compatibility [EMC! and Grounding 

Requirements for Space Systems Facilities 

HIL-STD-1543 



MIL-STD-1546 - Parts, Materials, and Processes Standardization, Control 

and Management Program for Spacecraft and launch 1'eoicles 

HIL-STO-1547 



HIL-STB-1574A - System Safety Program for Space and Missile Systems 

MIL-STD-1644 - Trainer System Software Engineering Requirements 

MIL-STD-1679 - Heapon System Software Development 

MIL-STD-45662 - Calibration System Requirements 
MIL-T-21578A 

HIL-T-ZMM 

MII-K-5088H - Hiring, Aerospace Vehicle 

MIL-W-8160D - Specifications for Installation of Hiring, Guided Missiles 

12, national Bureau of Standard Handbooks. 

NBSH 66 - Safe Design and Use of Industrial Beta-Ray Sources 

HBSB 114 - General Safety Standards for Installations Using 

(Ion-Medical X-Ray and Sealed Gamma-Ray Sources, Energies Up 
to 10 HeV 
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13. National Electrical Manufacturers Association (NEMA) Publications. 
MG-1 - Motors and Generators 

SG-2 - High Voltage Fuses 

SG-3 - Low Voltage Power Circuit Breakers 

SG-6 - Power Switching Equipment 

ST-20 - Dry-Type Transforaers for General Applications 

18-1 - Transfomers, Regulators and Reactors 

14. national Fire Prevention Association Publications. 

IIFPA 10 - Standards for Portable Fire Extinguishers 

NFPA 12 - Standards for Carbon Dioxide Systeos 

IIFPA 30 - Floatable and Combustible Liquids Code 

IIFPA 31 - Standards for Installation of Oil Burning Equipment 

IIFPA 50 - Standards for BuU Oxygen System at Consuaer Sites 

NFPA 50A - Standards of Gaseous HyuYogen Systens at Consumer Sites 

IIFPA 50B - Standards for Liquid Hydrogen Systens at Consimer Sites 

IIFPA 54 - national Fuel Gas Code 

IIFPA 58 - Standards for Storage and Handling of Liquified Petroleim 
Gases 

HFPA 70 - National Electrical We 

HFPA 78 - Lightning Protection Code 

HFPA 91 

HFPA 101 

IIFPA 252 - Standard Methods of Fire Tests Door Assemblies 

NFPA 255 - Method Test of Surface Burning Building Characteristics 

NFPA 257 - Standards for Fire Tests of Window Assemblies 

NFPA 493 - Apparatus for use in Division One Hazardous Locations 
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15. Occupational Safety and Healtti Administration Rules. 
OSHA 1910.109 - Explosives and Blasting Agents 

OSHA 1910.133 - Eye and Face Protection 

OSHA 1910.184 - Slings 



16. Air Force Technical Orders. 



TO DO-HOW 
TO 00-110H-3 



- Radioactive Waste Disposal 



TO 00-25-224 
TO 00-25-229 



- Melding High Pressure and Cryogenic Systems 



• Control and Use of Insulation Knitting for High Voltage 



TO 00-25-234 

TO 00-25-235 

TO 11A-1-42 
TO 11A-1-4? 
TO 14P3-11-1 



- General Shop Practice Requirements for the Repair, 
Maintenance and Test of Electronic Equipment (Phi'tco Corp) 



- Safety Procedures and Equipment of Confined Space Entry 
(Including Missile Propeilant Tanks) 



- General Instructions for Disposal of Conventional Munitions 

- Explosives Hazard Classification Procedures 



TO 14P3-I1-21 

TO 31A-10-4 

TO 312-10-4 
TO 36-1-58 



■ Rocket Fuel Handlers' Coveralls, Gralite Jacket, Self 
Ventilating Hood 



- AF Com. Service SVC (E-l STD) Standard Installation 
Practices, Delta Hatched Doublet Antenna 



■ Electromagnetic Radiation Hazards 



r Maintenance and Testing of 



TO 4285-1-2 
TO 42BJ-2-1-3 



- Use, Handling and Maintenance Instructions Storage Type Gas 
Cylinders 



■ Quality Control of Propellant Nitrogen Tetroxide 



TO 42B7-2-1-4 - Quality Control of Propellant Hydrazine, 

Dimethylhydrazine (50/50) mixture 

TO 4207-3-1-1 - Quality Control of Liquid nitrogen 

TO 4287-3-1-2 - Quality Control of Helium Propellant Pressurizing Agent 

TO 42C-1-11 - Cleanliness Standards, Cleaning and Inspection Procedures 

for Ballistic Missile Systems 

17. Underwriter's Laboratories, Inc. 

UL 555 - Fire Dampers and Ceiling Dampers 

UL 674 - Electric Motors aid Generators for use in Hazardous 

locations, class i, Group C S D; Class II, Group E, F 8 G 

18. Yandenberg AF8 Regulations. 

VAFBR 92-1 - Fire Prevention (SSI by 0P8) (4392AER0Sfi/DEF) 

VAFBR 136-1 - Storage, Handling and Inspection of Contractor and Tenant 

Explosives on Vandenbenj Air Force Base 

VAF8R 161-1 - Control of Ionizing Radiation 

19. HSHC Publications. 
Range Users Handbook 

HSMCB 55-7 - Aircraft and Aeronautical System Testing on the HC00A 

HSHCft 100-1 - Radio Frequency Management 

KSHCR 127-2, Vol. II - Launch Complex Safety Operating Procedures (LCSOP) 

20. Documents useful in preparing data required by chapter 4: 

ETIWG Document 103-80 - DUG Standard for Pulse Repetition Frequencies and 
Reference Oscillator Frequency for C-8and Radars 

ETHKG Document 111-65 

EIWG Document 114-69 - IRIG Pulse Doppler and Coherent Radar Standards 
ETMHG Document 115-69 - Hon-Coherent C-Band Transponder Standards 
FCHG Document 101-65 - Frequency Standards for Radar Beacons 
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IMG Document 106-59 

RCC Document 502-81 - * Glossary of Range Terminology 

RCCRSG Document 306-7S - Flight Termination Receiver Catalog 

RCCRSG Document 307-79 - Range Safety Transmitting System 6-549 MHz Band 

RCCRSG Document 308-79 • Range Safety Transponder Catalog 

RCCRSG Document 310-79 - Test Procedure for C-Sand noncoherent Radar Transponder 

RCCRSG Document 31 3-! 



Hestern Test Range Geodetic Coordinates Manual, Part I, (0PR: ROIS) 
BOTE: These IBIG documents nay be obtained from: 



Secretariat, Range Commanders Council 

ATTN: STEKS-SA-R 

White Sands Missile Range, IIM 88002 



21. Miscellaneous Publicatioi 
AASHT0 H20 

ADC 1062R3 - Air Diffusion Council, Equipment Test Code 

AfsCR 127-6 - Air Force Systems Coaand Regulations, Systea Safety Groups 

AFSCR 800-15 - Human Factors Engineering and Management 

AFSCti 80-12 - AFSC Standard Theoretical Trajectory Magnetic Tape Format 

AISC - American Institute of Steel Contraction, Specification for 

Design, Fabrication and Erection of Structural Steel 
Buildings 

ASHRAE - American Society of Beating, Refrigeration, and Air 

Conditioning Engineering 

CAL0SHA Title 8 



CG 108 - Coast Guard Regulation Rules and Regulations for Military 

Explosives and Hazardous Munitions 

CPIA, »ol I - Chemical Propulsion Information Agency 



National Aeronautics 
and Space Council 
Document 

NIB 17I)0,7A 
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- IEEE Standard Glossary of Software Engineering Terminology 

- Illuminating Engineering Society Lightning Handbook 

- Payload Ground Safety Handbook 



HAV0R0 Instruction 8 
SDR 127-8 
SD STD-73-3 



3.3 - Navigational Order, Hazard Classification Procedure 
- System Safety Engineering 



3 STD 79-1 



- Integrated System Safety Prog™ for the H-X tfeapon Systeo 

- Policy on Safety Associated with Earth Recovery of 
Satellites and Deep Space Vehicles 

- American Society of Mechanical Engineers Boiler and 
Pressure Vessel Code, 1955, SEC VIII, fJnfired Press, 
Vessels and Alternate Rules for Press. Vessels, Div 2, 
1968 Sec VIII, Boiler and Pressure Vessel Code 

- Missile Antenna Data Requirements 
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SOFTWARE SYSTEM DESIGN REQUIREMENTS 

1. Purpose. This guideline is provided as a ready reference for anyone designing or 
creating software for use with any missile or space vehicle which will be launched from 
Vandenberg AFB CA. This includes any associated ground support facilities or equipment. 

2. Scope. Unless specifically excluded, all computer software (including that 
associated with embedded computers/computer systems and test equipment) used to control 
or monitor safety critical ground or flight sequences, functions or processes shall be 
designed in accordance with this document. EXCEPTION: All computer hardware and 
software procured by WSMC/RQ for use by the Western Test Range (wTR) is exempt from the 
requirements of this attachment. WSMC/RQ ensures validity and safety of WTR procured 
computer equipment. 

3. Philosophy. It is recognized that the use of computer systems to control and monitor 
critical functions will continue to proliferate as systems become more and more 
complex. This is inevitable and not, in itself, undesirable. It is also recognized, 
however, that as software controlled systems become more complex the potential hazards 
introduced with the software also increase. Although software does not "fail" as such, 
it can be "faulty" or "error" prone. The usual causes of "faulty" software are: 

a) incomplete or incorrect software requirements; b) incorrect software code; c) insuf- 
ficient software testing; d) incompatibility with hardware; e} poorly designed, con- 
fusing, or non-standard user-system interfaces which are incompatible with or 
"unfriendly" toward the user«operator. Although it is probably impossible to make all 
software 100 percent error free, strict adherence to the principles and practices 
spelled out in these design requirements will go far toward ensuring software safety. 

4. Checklist: 

4.1. The system software shall possess the following general properties characteristic 
of high quality software: correctness, reliability, validity, resilience, useability, 
clarity, maintainability, testability, modifiability, generality, efficiency and economy. 

4.2. Any single CPU controlling a process which could result in major system loss, 
system daraage or loss of human life shall be incapable of satisfying all the 
requirements for initiation of the process. 

4.3. A status check of critical system elements shall be made prior to executing a 
potentially hazardous sequence. 

4.4. Upon completion of a test where safety interlocks were removed, the restoration of 
those interlocks shall be verified. 



4.6. The results of critical algorithms shall be verified prior to use. The software 
shall verify safety critical parameters or variables before an output is allowed. 
Parity or other checks shall require two decisions before output. 

4.7. Program design and code shall be structured to enhance comprehension of program 
logic 



4.8. Program design and code shall be modular in an effort to r 
improve logic error detection and correction functions. 
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4.9. Hazardous processes requiring critical timing shall be automated. 

4.10. When software generates a hardware command, an analysis shall be performed to 
determine if the command should be continuous until reversed or only used for a discrete 
length of time. 

4.11. The software shall require an operator response for initiation of any potentially 
hazardous sequence. 



4.13, Decision logic using registers which obtain values from end-item hardware and 
software shall require a specific binary pattern to reduce the likelihood of 
malfunctioning end-item hardware/software satisfying the decision logic. 

4.14. Operations employing time limits impacting system safety shell have these time 
limits included in the logic. 



4.16. The software system shall respond to pre-defined anomalous conditions by 
notifying the operator of the condition. 



4.18. Upon detection of a predefined safety critical anomaly, the software shall inform 
the operator what anomaly was detected. 

4.19. Upon detection of a predefined safety critical anomaly, the software shall inform 
the operator whet action was taken. 

4.20. Upon safing the systen, the software shall identify the resulting system 
configuration or status to the operator and await definition of subsequent software 
activity. 



/ critical hardware items shall be designed into the 

4.23. All safing requirements shall be detailed in the software design specifications. 

4.24. Operator interactions with the software shall be concise. 

4.25. The software shall provide for detection of improper sequence requests by the 
operator. 

4.26. The software shall provide for notification of improper keyboard entries by the 
operator. 

4.27. The software shall not allow a hazardous sequence to be initiated by a single 
keyboard entry. 
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4. 28. Thy software system shall protect against unauthorized access. 

4.29. The software shall provide for operator cancellation of current processing, 

4.30. Operator cancellation of current processing shall require a single operator 
response. 

4.31. Cancellation of processing shall be accomplished in a safe manner. 

4.32. Any override of a safety interlock shall be identified to the test conductor via 
display on the test conductor's CRT. 

4.33. Software controlled sequences affecting safety shall require a minimum of two 
independent procedures for initiation. 

4.34. The software shall be developed such that inadvertent instruction jumps are 
detected and protected against. The system shall provide for a fail-safe recovery from 
inadvertent instruction jumps which could result in a hazardous condition. 

4.35. The software shall discriminate between false and valid interrupts. 

4.36. The computer system shall be itsune to the effects of temporary power 
irregularities. 

4.37. The computer system shall be sufficiently protected against the harmful effects 
of electromagnetic interference. 

4.38. Software shall he developed to safely handle contingencies. 

4.39. Separate 'MB" and "EXECUTE' cotnands shall be required for ordnance initiation. 

4.40. Interrupt priorities and responses shall he specifically defined. 

4.41. Interrupt priorities and responses shall be specifically documented. 

4.42. The software shall he initialized to a known state. 

4.43. There shall he provisions to protect the accessibility of memory regions dedicated 
to critical functions. 

4.44. There shall be periodic memory integrity checks. 

4.45. Unless specifically exempted, input/output ports shall not be used for both 
critical and non-critical functions. 

4.46. Critical input/output' ports shall have addresses sufficiently different from 
non-critical ports that a single address bit failure will not. allow access to critical 
functions or ports. 

4.47. Software programs shall be designed in a hierarchical manner where the levels of 
the hierarchy correspond to levels of control of the tasks performed by the program. 

4.48. "he components of a hierarchical program shall be closed subprograms, or the 
equivalent, of a size which can be reasonably comprehended and viewed. 

4.49. Subprograms that are called from only one point or that operate upon the same 
data at each call shall be unparameterized. 



4.51. Validity checking by the components of a hierarchical program shall also be 
arranged hierarchically - gross checking being done at the higher levels and detailed 
checking at the lower levels. 

4.52. Critical subroutines and subprograms shall include a "come froo" check to ensure 
that tiiey are being called from a valid calling program. This usually involves the 
calling program setting a validity code or flag and the subroutine checking the code 
prior to taking any safety critical act ; on. If an error, such as an illegal entry into 
the subroutine, is detected, a "jump" to a specific safety or error handling routine 
should be made rather than a "return" to the calling routine. 

4.53. It shall not be the responsibility of a lower level component to check the 
validity of the data or parameters provided to it by a higher level component. 



4.55. Program components shall be programed in execution order; that is, components at 
the higher levels in the hierarchical program organisation shall be programed before 
components at the lower levels. (Calling routines shall be programed before called 
routines.} 

4.56. Dummy called routines may be employed in early checkout; dummy calling routines 
are HOT permitted. 

4.57. Hhen a routine is programmed, it shall be programed to comply witu an interface 
that has al ready been programed. 

4.58. When a routine is programed, it shall always be possible to check it out with 
the components at higher levels in the hierarchy. 

4.59. Logic shall be standardized in such a manner as to enhance the readability of 
programs and to eliminate intricate logic that is difficult to validate and verify. 

4.60. software should be designed and shall be coded using only the five basic control 
structures presented in Figures A3-1.1 - A3-1.5. They are: the SEQUENCE of Operations 
(assignment, add,. . .), IF TffiB ELSE (conditional branch to one of two operations and 
return), DO WHILE (operation repeated while a condition is true), DO UNTIL (operation 
repeated until a condition is true), and CASE (operation which provides the transfer of 
program control to a specific location within a compile-tiine system). 

4.61. The readability and comunicability of program routines shall be enhanced by 
restricting their size to that which can be easily viewed and comprehended. The maximum 
size of a set of instructions which may he called shall be fifty (50) lines of 
instructions unless otherwise approved by HSHC/SE in conjunction with the procuring 
authority. 

4.62. Application software that affects the system's operation consoles shall provide 



4.62.1. Operator visibility. 

4.62.2. Positive manual control. 
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4.62.3, Support of testing with software that executes test sequences with minimal 
operator input, 

4.62.4. Automatic fault isolation/notification and correction, where applicable. 

4.63. The software system shall make reasonable checks on all safety critical inputs. 

4.64. The software system shall display safety critical timing data to the operator. 

4.65. The software system design shall conform to MIL-STD-1 472 with regard to display 
color usage. 



4.66.1. Providing, as a minimum, a two step operator request to resolve safety critical 
interrupt limits. 



4.67. in the event of system console failure, the software system shall ensure: 

4.67.1, The continuance of processing according to operational requirements (by 
implementing orderly shutdown and hold, transferring control to a backup console, or 
continuing to operate if coordinated with and approved by WSHC/SE). 

4.67.2. The software portions of the system are not allowed to remain in a predefined 
hazardous configuration. 

4.68. The software system shall provide status of applicable system health and data 
validity in displays. 

4.69. The software system shall verify the existance of prerequisite conditions prior 
to CGEinrnQ issuance in accordance with pre-defined operational requirements. 

4.70. The software system shall indicate to the operator the o.,eration[s) and 
functions(s) currently active. 

4.71. The software system shall identify to the operator that safing function execution 
has occurred and provide the reason for the execution and a description of the safing 
action taken. 

4.72. All application software sets shall use standard MEH system and INTRA system 
communication techniques which are compatible with the total automation approach. 

4. 73. The software structure shall allow the adding of interfaces within a system, or 
between systems, and the single control point without requiring changes to architecture. 

4.74. An application software set shall provide manual conanand capability of all 
coixidndable critical system components through the use of display programs. 

4.75. An application software set shall not be dependent upon keyboard commands other 
than to initially perform the level one program which activates all concurrencies for 
the application set. All subsequent Keyboard interfaces shall be to currently executing 
application set software. 
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4.76. The software structure shall be standard and allow for additions, deletions, and 
modifications of software modules to accommodate requi rement changes with no adverse 
impact to the safety of the system and with minimal impact to the software application 

In particular, changes shall not affect timing, the interrupt priority system or 

1 ' ' ? of modules/data. 



4.77. The application software set shall initiate an emergency mode operator request 
within five (5) seconds even if a previous nonemergency request is in progress. System 
safing is an emergency mode operation. 

4.78. An application software set shall provide fault tolerance capability (for 
example, through redundant sensors or measurements, voting routines and multiple command 
issuance) for commands and measurements such that individual commands that fail to 
operate normally or individual measurements that contain incorrect or out-of-tolerance 
data may he bypassed or ignored. 

4*79* An application software set shall ensure proper configuration of inhibits, 
interlocks, safing logic, and exception limits at initialization* 

.80. Each application software set shall determine and maintain the status of its 
system and environment upon initialization and during operation. 

4.81. An application software set shall detect failures within the computer system 
elements and perform system monitoring and control through backup or redundant paths 
when primary sources fail. An application software set shall use redundant measurement 
voting when possible. 

4.82. Each application set shall provide the capability for autooatic fault detection, 
problem isolation and automatic recovery. This capability shall be provided based upon 
the availability of system data to define a fault isolation plan and where predictable 
fault sequences and correction can be accomodated. This capability will minimize the 
requirements for operator intervention when critical anomalies occur. 



4.84. To ensure that the current status of a system is visible to the operator, an 
application software set shall provide an overall system display program. The operator 
should be able to manually select detailed displays of subsystem components from the 
overall system display. 

4.85. Subsystem displays shall be provided to give detailed visibility of all system 
components. 



4,87. All display programs shall have a variable delay in the display loop which the 
operator can change at run time. 



4.89, Programs shall include routine checks and recovery possibilities that a 
"forgiving" of common user and data errors. 



4.90. the software should be developed such that the majority of the safety critical 
decisions and algorithms are within a si ngl e (or few) software development nodules. 

4.91. If timing is critical, the counter's oscillator shall be checked against an 
independent time base. 

4.92. If a "watch dog" or "babysit" type circuit is implemented, the circuit shall be 
totally independent of the computer that it monitors and should begir, to monitor the 
computer as soon as possible after computer power-up (the circuit should not be 
initialized by the computer). 

4.93. If it is critical that the computer remain on at all times (for example, for 
destruct modes, shut down sequences, etc.): 

4.93.1. The computer shall be protected against power interrupts, power surges, stray 
voltages, and gradual depletion of power supplies, 

4.93.2, Consideration should be given to connectors and sockets to ensure continuous 
continuity, especially in high vibration environments. 

4.94. Each software module shall have a single entry and single exit structure. 
(See fig A3-2). 
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SEQUENCE: Process A, Process 8 



Control flows froa process A to the next In sequence, Process B 
Figure A3-1.1. 



If TM ELSE: If condition A THEN process B, ELSE process C. 




HlH 



The flow of control will return to a coram point a F ter executing either process 6 
or C« A predicates the conditional execution. If control is to skip a process 
pending the condition of A, then the flow chart can be modified thusly: 




Figure A3-1. Control Structures. 
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3 WHILE: DO WHILE condition A, process 




The DO WHILE structure is a loop in which the condition A is evaluated. If found 
to he true, then control is passed to process S and the condition A is evaluated 
again. If condition A is false, then control is passed out of the loop. 

Figure A3-1.3. 



DO UNTIL: DO UHTIL condition A, process B. 

The 00 UNTIL structure is stellar to the 00 HiiLE -- except that the test of 
condition A is perforped after process B has executed. Thus the 00 UHTIL will be 
performed once regardless of the value of condition A. 



CASE: Based on CASE conditional i, process i 




Control is passed to process k based on the value of i 
Figure A3-1.5. 



Figure A3-1. Control Structures (continued). 
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figure A3-2. Nesting of Control Structures. 



HIGH TERMINATION C0*SM> HSIEM Rf RADIATION CHARACTERISTICS 





SITE! 


SITE 3 


SITE 4 


SITE6A 


SIIE6B 


GEODETIC 
LATITUDE 


34 46 12.1971 


34 35 27.0748 


37 29 48.7811 


34 6 26.8592 


34 6 27.1306 


GEODETIC 
LffllGITUDE 


120 30 22,7504 


120 36 43.8591 


122 29 55.9235 


119 3 57.1449 


119 3 57,0067 


GEODETIC 
HEIGHT FEET 


767.39 


1101.98 


62.76 


1282.03 


1304.87 


M.S.L. 
HEIGHT FEET 


890.00 


1224.97 


176.60 


1401.50 


1424.34 


TRANSHTrER 
FOBER 


10 KW 


10 KH 


10 KB 


10 KW 


10 KW 


GROUND LOSS 


1.0 dB 


1.0 dB 


1.0 dB 


1.0 dB 


1.0 dB 


STEE8ABLE 
AffiHINA 


YES 


YES 


YES 


YES 


YES 


TYPE 


15 FCOT DISS 


15 FCOT DISH 


15 FOOT DISH 


15 FCOT DISH 


15 FOOT DISH 


SiS 


23d3i 


23(ffii 


23 d3i 


23 <Bi 


23 aa 


poimanos 


LEETHAND CEOJLAR 


lefthand cmcoiss 


LEETBA8D CIRCOIAI 


LEETHAND CBCOLAI 


LEETHAND CTSOMR 


Bmvmm 


10' g 3 SB 


io° e 3 a 


10' § 3 dB 


10° S 3 dB 


10° § 3 dB 


AXLE RATIO 


5» 


5 SS 


5dS 


5 dB 


5dB 


SEW USE 


127SEC0B 


12YSECOND 


10YSECOSD 


10VSBCO9D 


10YSECOND 


A2IMJTH 
COVERAGE 


im 'COVERAGE 


TOTAL COVERAGE 


CKFKCM 
125" TO 300" TSGE 


CBFBOM 
135° TO 315° TRUE 


Of PROM 
135° TO 3!5° TRUE 


elevation 
covefags- 


+1° TO 90° 


+1° TO 90° 


*r TO 90° 


+1" TO 90° 


«' TO 90° 


WO/BBS 
ACCURACY 


tl° 


+1" 


+1° 


«° 


«° 


GHNI ANTENNA 


yes 


YES 


NO 


so 


NO 


GAIN 


OdB 


da 


N/A 


8/A 


N/A 


POIARKAHON 


LEFfflAKD CMMI 


imsm circular 


N/A 


N/A 


N/A 



NOTES: 

1. GEODETIC COORDINATES ARE DEPAEESBT OF DEFENSE KCSLD GEODETIC 

2. POLARIZATION IS ACCORDDE TO IEEE DEFINITION OF SPSE, 
149 JAN 65, PAGE 7. 



frequait « Miljjge_- faUica^ 



Gonial Use - Crtti 



Frequent or gaily Use - Unncrftial 





